Extracted

Extracted

• • Target

    af14477a5620417462fbace53e16a969cadb424613cff661fa0419071f35c2e8

  • Size

    1.0MB

  • MD5

    a1ffc02fd4f69cfa386ab38d4d522c68

  • SHA1

    3acd31dc4b245dd1fcbc15c4596cd1defa8647f7

  • SHA256

    af14477a5620417462fbace53e16a969cadb424613cff661fa0419071f35c2e8

  • SHA512

    acaa12d03a6237672b725de1f4676a88f76a9717f0ce133bc1368e911c8f56a2ea468248e4125659ec32315f66dacf3e658011217ed162ed0d925984564111ed

  • SSDEEP

    24576:Tywk709HL39N6cU/j5pa/eB76VxSPJjR4SCEbYxpMZU7pTyLDI:mwk7YLNv4j57+VxSBd4dEcAuqD

  Score

  10^/10

  amadeyredlinedisaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1