Extracted

Extracted

• • Target

    688160ddd485187289d783cf9d63bcfbc5a5ade5b0936601def57cb5d20825ad

  • Size

    1.2MB

  • MD5

    b0fdc037506b87d391fd4acc3650828f

  • SHA1

    387e2e37036a307e129cdc4203cdb72b46afce94

  • SHA256

    688160ddd485187289d783cf9d63bcfbc5a5ade5b0936601def57cb5d20825ad

  • SHA512

    f4c289f5c7bb921cc7e6e604fc5d71c3986c7f62a21f44f5a9b72f1a45112633d7633eb668d83feef594302c1facdf8254b7304f54b97c5f2500ab2a826750fc

  • SSDEEP

    24576:FyVIEfoqRQvyB6K634c6lL3pkz8viDh4+vM4Zm8idDjqvcFNi7vq7U4ZTycy3s3K:gVHfoAQq61o3LWyqUJ8gjVqvq7U4lby3

  Score

  10^/10

  amadeyredlinediroladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1