Extracted

Extracted

• • Target

    bd28199ea4825945634f93fcd39aedb3041d4c7f10f9d1dce1d30f0d566f8853

  • Size

    1.0MB

  • MD5

    12da1cb7a1fd4089e20de1b2ad5f985c

  • SHA1

    de41a44dd354cee8579658f8aba60993894f8df2

  • SHA256

    bd28199ea4825945634f93fcd39aedb3041d4c7f10f9d1dce1d30f0d566f8853

  • SHA512

    dec328056b4cc3fa70d0175510ad5e9fc51801ec84bd12ebef01de3ac4cf642930c31c23012618636b576629d909d827eefd86f80be5f011b4061e4872644e5e

  • SSDEEP

    24576:rykC4rb2ZU8CDhZ6WUk6ykgEVv049+1xZ8aN:ekC4/8Cvv6ykgEVv0ZV8

  Score

  10^/10

  amadeyredlinedisaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1