Extracted

Extracted

• • Target

    fc5f9774e0a506e44f0c9919e654996c523bb1a67f5d0ba664b9c2723e5ef2f8

  • Size

    1.1MB

  • MD5

    6c517d4938304e04c9a715210ec73640

  • SHA1

    12d4b29af3bea4b981306c36f18872327cceaace

  • SHA256

    fc5f9774e0a506e44f0c9919e654996c523bb1a67f5d0ba664b9c2723e5ef2f8

  • SHA512

    8e5a9040ae94ec1a42cfceef072e2fb8ee3521c70fa3dd093e60cd758f7fe78d65e99d566c56a79176f4b5f6d535aa9b3df19597ab6938faa9897f07cb8e296f

  • SSDEEP

    24576:Ay4b8rytaAqKZAJ6vb9S+RxYwFhZbVjcuotO:HW8eta5SAQvb4+1B5ox

  Score

  10^/10

  amadeyredlinedizaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1