Extracted

Extracted

• • Target

    69309787d1e0bf139b47255852b465a452a1e99e6d733d69cf2919d858ed8482

  • Size

    1.2MB

  • MD5

    ee6d95388ca2c343011cd94c339d1392

  • SHA1

    f89592e46d45d6193c158d027c9e5fa90423f2b3

  • SHA256

    69309787d1e0bf139b47255852b465a452a1e99e6d733d69cf2919d858ed8482

  • SHA512

    db50cd3333822165bb333ca07828b6c28fb3ebc7770808e4ded9538402c300b0994eba7bd92f33f70fdf425dd26f13ab40f852efc18b3009caab9935339611bd

  • SSDEEP

    24576:9y4snPLZmMS3N8juvdE2DYZco4kSZJnR+S7HnO:Y4szZkNooo74kSfR+8H

  Score

  10^/10

  amadeyredlinedisaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1