Extracted

Extracted

• • Target

    1e1d30943f7feec9033c18c4e7b7c80fb3b9701e0fb0200ef3785da35f2f0383

  • Size

    1.0MB

  • MD5

    61f41e455af331ac2c4f07b5d8238607

  • SHA1

    55f94d1522ef44c9bff1e5b132879f492b7c3a1b

  • SHA256

    1e1d30943f7feec9033c18c4e7b7c80fb3b9701e0fb0200ef3785da35f2f0383

  • SHA512

    4c27902e86f1df2e4045c896f8579a24dc355c52c683059f015648ccb0509fe1cd7adcdad2ba0dc7667c6974bd292597da804e9073fb6530b4d9172096f1df19

  • SSDEEP

    24576:6yYkdhCJASRx+qxRY3qADbIz119F4Q89eF8E71rK:BYoTSRsqPYnIz1zy1UF9

  Score

  10^/10

  amadeyredlinedisaladadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1