Extracted

Extracted

Extracted

• • Target

    9eac84c6f56e56375579b0afdbf028876abb408a87d472520a72138883e62244

  • Size

    1.5MB

  • MD5

    f6318f9330405793e74d99cc49016c0a

  • SHA1

    420edc865c619b3a915a6847145aacc2c882cdd1

  • SHA256

    9eac84c6f56e56375579b0afdbf028876abb408a87d472520a72138883e62244

  • SHA512

    37cd83df16959082fb5fa8eda83c6c148a12eaa7c9dfc492c384450ff40d3370af10eb5cd3c9695be72af408c3f1997859cd3767f7437225665562a58f1b1f4d

  • SSDEEP

    49152:wh91dOMNRtWUtJSxzULyAayunTIbv0XL2:g91dOMNRUQAULbayoTDXi

  Score

  10^/10

  amadeyredlineladamasidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1