Extracted

Extracted

• • Target

    7e3dfe60e506001efc5587d4891193c39b8c542df7299d3e1735e4061fe80117

  • Size

    1.2MB

  • MD5

    eecac2b7ec7f1db67ec9249c688a8dbb

  • SHA1

    8cd532f924280b4fa81c406dab288097ddfe0d45

  • SHA256

    7e3dfe60e506001efc5587d4891193c39b8c542df7299d3e1735e4061fe80117

  • SHA512

    a6bf0f36e8c02676a29b5841b1f4acbf274334fb98dd1a444a45adb71f68f8ec9b4e96a67787747f2810811cb1b7c142e08160b6e825cd8b504a5d503232833b

  • SSDEEP

    24576:GyP1T3yUCrqSGeYlHkXoGlDhY7v+RYm8W61+1fkXSrIiGXo:VP1T3yU2XqkvmW98H+1Nrq

  Score

  10^/10

  amadeyredlinediroladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1