Extracted

Extracted

• • Target

    d0d5573767624c8a9342a7b0925060104d3bbb3929e6bb057ddd47c2e1ad32b4

  • Size

    1.0MB

  • MD5

    447ce145ed69912c93e218155418b211

  • SHA1

    62658ffece4c237ce638553916f7be045b968e47

  • SHA256

    d0d5573767624c8a9342a7b0925060104d3bbb3929e6bb057ddd47c2e1ad32b4

  • SHA512

    04fac7940176002e377edefbcba5ce6cadd61c73d279cd2b1df749fa6e6d86115ee52563ea6c9bc9b6857c78ce0ba9817f6e5ba9afa66008ca31c1c504258beb

  • SSDEEP

    24576:kyztZ4MS/VYMF+rfVrSHLIUgccWGcogYqU02+DSZ:zsrWMFkqIXccWGMh2+DS

  Score

  10^/10

  amadeyredlinedisaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1