Extracted

Extracted

• • Target

    5b538e93785cd930b9f5506213e20659186a3597f6cbcffe145ede3718c94687

  • Size

    1.2MB

  • MD5

    cf9cab8f64072e139916f3b5d943d30f

  • SHA1

    8cd6e335a5a033e2a89fcf8fe9620ef7bb754838

  • SHA256

    5b538e93785cd930b9f5506213e20659186a3597f6cbcffe145ede3718c94687

  • SHA512

    40902567071079639068aee2fd7cf2dc858650936f14295b14f5ecafede1ecdad46c7c76042a04a3799c9c2edda7ce03727012ffeb4e246101da16a6e8857844

  • SSDEEP

    24576:jyfMGYbHbi7iGzH+OB9aFh8DHESo+2POZmx/dpw5J:2fnUGFyWaFh8w9mZ0pw

  Score

  10^/10

  amadeyredlinedizaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1