Extracted

Extracted

Extracted

• • Target

    9991e5c6208deb9a2d6799b7e70a41347437ab727f0275f8ac72e407df5c638a

  • Size

    896KB

  • MD5

    71438c9a356755499456c4ca0bf922c1

  • SHA1

    d4d4be81b78a1618b3bd788635ace44a4e86c4c9

  • SHA256

    9991e5c6208deb9a2d6799b7e70a41347437ab727f0275f8ac72e407df5c638a

  • SHA512

    ee235cc463fa07a1043bad5f19de06197ad8681c56ca6f9926d434f166d7595bd2dd3aa51de09d7bcceaf8b878d28078aefdcd3223dd3be07433b50bbd9a2f09

  • SSDEEP

    24576:Hynp+WHzTfBCMhkme8L7gef1s9FqrDCJ/i35:SjfBCWk7Q7vsLODCJa

  Score

  10^/10

  amadeyredlinedizaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1