Extracted

Extracted

• • Target

    7d1db2ed01de30d2ce3279662d3bb1eb3aae985a77b2ad0fd68abfae1dffef86

  • Size

    1.0MB

  • MD5

    3f88a379ff0c6e855d7c0c87371aa3e7

  • SHA1

    11c42eb192bf0a04b0bc6dd9732811f02ec6ad68

  • SHA256

    7d1db2ed01de30d2ce3279662d3bb1eb3aae985a77b2ad0fd68abfae1dffef86

  • SHA512

    747ee219e7dd28ea0f8f6484b55ca0e2f1e281d37c7e3889d7bf78e975f9abe47af26616856c5140e95b9aa496f4158e50f4575a91619d40f3adecd06d5b8bd6

  • SSDEEP

    24576:UyLDdxMKCOLUuR6KQx0RkkrZ2stO8lpreIn3:jLDdxMKCFq6eF20iIn

  Score

  10^/10

  amadeyredlinedisaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1