Extracted

Extracted

• • Target

    e35812b32e9406d99849d81fd9d8a5ce3363985e1ccf4be66c67ae4479d1ffb2

  • Size

    925KB

  • MD5

    9c444a90a279892ede7a161a5a3e92b0

  • SHA1

    e07b1f3780c5142f76959306b82064b1035150c4

  • SHA256

    e35812b32e9406d99849d81fd9d8a5ce3363985e1ccf4be66c67ae4479d1ffb2

  • SHA512

    731f87190b808adbcb12e347ed64a221a0af24f8b82a5366835ef3f36286092200800c9dd51e92359fa9c69f46369d82262b71a67f123fa9edce71c7aede3f55

  • SSDEEP

    24576:1yvStK261h5b9hC8J8cNMuEPzaxy0t95Ag3kZfx/Ej:QvgK261h5q8GcNYzXi5L3kZpM

  Score

  10^/10

  amadeyredlinenahuirosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1