Extracted

Extracted

Extracted

• • Target

    f9de8d0a137d661331f79665df6ea14f83714e49adaffd7701a1da299ee10c8c

  • Size

    895KB

  • MD5

    eb82f9f3f13b141573b0c1d729e59419

  • SHA1

    ad8d274b97a33f467d1e9976e199107f1f4aa474

  • SHA256

    f9de8d0a137d661331f79665df6ea14f83714e49adaffd7701a1da299ee10c8c

  • SHA512

    316eb4caa1ce25e69848504edeac6ffc93d770458d5785a4ac33df9384590af53bcd9bfde798ef871bc6f26f1ff07aff5f9d9ce2cf07588ca5cb201332bc0c26

  • SSDEEP

    24576:bygUYcjfz2R+f0pacba2ZXL7loJJ9jOqnMsUlG:O6yr2R+f0RP7wJZnMsu

  Score

  10^/10

  amadeyredlinedizaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1