Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    1.4MB

  • MD5

    586bdc06c16af999dfa745c1eedb132e

  • SHA1

    dfbecccc20ba647ff1a050a289ee0b001f4be9fb

  • SHA256

    7088f7009cb64b9a282b722e44bd227a191c8baf619e65175282b0c70da10a9b

  • SHA512

    e301d5abf5e49f285715ae0f8fe2b09166c2615b82b4bedd6e95b02a3ea6285efac792989164c973ece3dcb9564d03fc6409823423b155c8794101d80509e7ea

  • SSDEEP

    24576:nyYcdOBZ6Z8+dskIFXp1nxJJTIZWCC2px/12MiUmkcBIiYUUEuJ61J1fvUK2xume:yYovdskcp3DQzhpxInekIiNBuJ6b1fMR

  Score

  10^/10

  amadeyredlineladamaridiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2