Extracted

Extracted

Extracted

• • Target

    637108277aef4af1ee7311ace601ad91dba83116f15dffcd13499f939500f3b5

  • Size

    896KB

  • MD5

    83c1b1a0ed4984705056b07154d96aac

  • SHA1

    40837bd83838c9b63e44705e0e2e606b83bd2270

  • SHA256

    637108277aef4af1ee7311ace601ad91dba83116f15dffcd13499f939500f3b5

  • SHA512

    e9604cc616bc5046363a3bcd9f333bdf84131b15421f735555bd1cb3f40a38a3ddbdfdd6ff6e5199df84275e5c86a763932c3f5a16e69c41a9bb6c55d9a9c7eb

  • SSDEEP

    24576:KyiSC/qQnWK1OviB+ccHmzvPbORxYVnyxb4F:R5CCKEvLccavoYVkb

  Score

  10^/10

  amadeyredlinedizaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1