Extracted

Extracted

• • Target

    4105681a7feb63ced726b5bbf05a3396580059597f578d5827e2fcc40fad5919

  • Size

    1.2MB

  • MD5

    5128aea99a02a35a64eb5422bbe170a0

  • SHA1

    08cde72eea84bece9e6a152fe9dfd7b1908e5979

  • SHA256

    4105681a7feb63ced726b5bbf05a3396580059597f578d5827e2fcc40fad5919

  • SHA512

    27c2916c0e7a64219f1f74402122c3f04ee534b6d16a303d1bb2741c875480971b5ff363c4056809e0b70ed8b068212cbd600b80f2c3390be7f91e661481f24f

  • SSDEEP

    24576:KyPNJbImKAE8cQipxCz61u9NsuWV5PYnOr:RlJbmRxCz61CyuWV5i

  Score

  10^/10

  amadeyredlinedisaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1