Extracted

Extracted

• • Target

    45ad5e020ea83b89656ac1608876beb940fa60d19159e0b3121a0d1cab5a05f5

  • Size

    952KB

  • MD5

    5f23a69eec07b5fb89a81a2323248047

  • SHA1

    0c6f584668a7e7a4e90c73e03101f30768ced84e

  • SHA256

    45ad5e020ea83b89656ac1608876beb940fa60d19159e0b3121a0d1cab5a05f5

  • SHA512

    76147ea7c1fd22229796115ccb18647640b4b189a9aa3139a42d8c38c7e89caf48719289a6b345ea84dc46ac584584ac58538d01ebf841e77671c5d204c3dd47

  • SSDEEP

    24576:Ryowa3DuI9vTcJAutoMN9EZhl45rak6Y8:Eva36wPulaZhQrak6

  Score

  10^/10

  amadeyredlinediroladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1