Extracted

Extracted

• • Target

    93ba71ee2692123fd47045e5da7ff77e9d83b24e027300a16d193446648bd17f

  • Size

    1.1MB

  • MD5

    1ef325546496f0af52f012191fe91fd7

  • SHA1

    e8bcd7c0ff802c71393bf642bcd50463b79a212b

  • SHA256

    93ba71ee2692123fd47045e5da7ff77e9d83b24e027300a16d193446648bd17f

  • SHA512

    e7bcce5368a93c33f924c605ad264f620ca47c44cbdd5abd457023061e6fd4a88275c2f1e45b34b359dc50334e11b84f9128efe84c283da5ab076503e6621948

  • SSDEEP

    24576:QyJ+A3cOlNec+VQEoQ8h1u5IJG6G0rsbMSYDRhdCt2n:XJ+M//Z+V9bqu5F6X1VC8

  Score

  10^/10

  amadeyredlinedizaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1