Extracted

Extracted

Extracted

• • Target

    6b1cbb3208c0f2797af232bf224cd735a7bd7a683ec18f69fcba7a0140b6e41f

  • Size

    1.5MB

  • MD5

    6edebd6fc2dc40f92205bb5600011c46

  • SHA1

    1f1eb4ae3a4c11ef25bd4f2f5366e0849af00f04

  • SHA256

    6b1cbb3208c0f2797af232bf224cd735a7bd7a683ec18f69fcba7a0140b6e41f

  • SHA512

    e7dab9f2b770c1132e5b13e37fc6796c9d1c57c47668bc8e5026d4dc7cdaa356106a93000996033bfaf3299eb7f99ccaabd807e81a51d6e51008c24e324ed774

  • SSDEEP

    24576:hyjbYGtZiwmmuj1XcCUYQQJaHj76CJntJEF0EOujdfFG5p5utGj1bRfbZK+7fqw6:UjbYXwmtUdQK79nJZEDJfUEGwmCw

  Score

  10^/10

  amadeyredlineladamaxidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1