Extracted

Extracted

Extracted

• • Target

    78761d787c94ee895a30725eaaa9122dee2ee8bba6926ea59682c758a45f0093

  • Size

    1.5MB

  • MD5

    0607598868046876d5584a712ea0c310

  • SHA1

    01798c615481e9867549711e15c25af336573f01

  • SHA256

    78761d787c94ee895a30725eaaa9122dee2ee8bba6926ea59682c758a45f0093

  • SHA512

    bd52649d8d0799297ed399464d228ebf5592d9bdbb401b7f2f387e34a16b970c48dcf2b8f7978aa263b11dacc3688c91a07de7651be7e2ab06bb8ad3d6daace9

  • SSDEEP

    49152:iPcRb7ZkAvASbdCDgr9WIutQ33I1kdZ4IUdMxTzJ:qcRR1vePZi3IaTrTxz

  Score

  10^/10

  amadeyredlineladamasidiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1