Extracted

Extracted

Extracted

• • Target

    b0a795e97e10078981597d199574dd06f720082a4f4086b0d2bcd15798cc2060

  • Size

    982KB

  • MD5

    f1231b70e6decd145c0546b764d45a02

  • SHA1

    dbc60203497eb2f5004f86b700b6a0eae6db1ae9

  • SHA256

    b0a795e97e10078981597d199574dd06f720082a4f4086b0d2bcd15798cc2060

  • SHA512

    443b70c143b6807a7703df2e7130a4d2166f5b26d4e574a0f885d395695a44419b2d54ff7f93f73665cd4aa6e912b20af3adf13e14b3dc97183e8158ffc027f6

  • SSDEEP

    24576:hyTnCLLhj3oc+HM378FyHAlbGccCmdIqXc7L4CmXjp6IPJfWREGvxs6Z:UTno2c+HMr9HA1GLkTne/NWR1xs

  Score

  10^/10

  amadeyredlinenordrosndiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1