Extracted

Extracted

• • Target

    9403dcabf843805f36dc16f1623f15b900559b0dbf73689f0d642dd8c68da0b4

  • Size

    1.0MB

  • MD5

    9a754453c9de316f993b2e9b9e7dbe42

  • SHA1

    c637c502bcbe0e110e2b90643409b9e53570eeb5

  • SHA256

    9403dcabf843805f36dc16f1623f15b900559b0dbf73689f0d642dd8c68da0b4

  • SHA512

    05a133cfd007ee60fd52557d5307184a3bb4bbe9fdf3c7fef93aaa3995678fd3317332d7f8168d4ca5b10f845a6d7cbb7e0d492c73856eeb27d5ebc3b9eae01a

  • SSDEEP

    24576:iyaw+3wuJgqki6D9FTsdAPCRZ37yJoOdsJ2t/xv9cb:JawoTki6D9TaRV7yJo3wtb

  Score

  10^/10

  amadeyredlinedisaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1