Extracted

Extracted

Extracted

• • Target

    7d869e407087045db06a2c06a302ce21e47ab1b9673db1d7d491e6f808d885cd

  • Size

    1.5MB

  • MD5

    eade5359938e381dec18fc6cc27a269c

  • SHA1

    bc9eaefce6b2fa80fe3e4e49528b92e5ff8e028f

  • SHA256

    7d869e407087045db06a2c06a302ce21e47ab1b9673db1d7d491e6f808d885cd

  • SHA512

    100a5e398216ff8f153f19b66b0b5d81470f3bab0f3a40664a470af23661b795d0bb10c8bf26165531f6161aba3cd15644fa2e8478c3a430ab412348b28938e4

  • SSDEEP

    24576:MyXoIJBYuFDuUDbttsCNEZ/V3RxZuRtpzp9uDwzwr1e4jJARP762IkLRMpI1p5s+:7XNBtFqctJEFt3ZaDRK1e49wP76Nks

  Score

  10^/10

  amadeyredlineladamasidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1