Extracted

Extracted

Extracted

• • Target

    534b9bda8cca7b4b92db2ae5a8e79a9a6be6d3f3806575fe2d4cff73a6b1cf09

  • Size

    1.5MB

  • MD5

    9698313ced80a5b0618ec1a45d924c3c

  • SHA1

    12d48acf565cdc7835fc58a9a709245cd2a35aeb

  • SHA256

    534b9bda8cca7b4b92db2ae5a8e79a9a6be6d3f3806575fe2d4cff73a6b1cf09

  • SHA512

    148c39a26697765d194eb01aec0237addb57a4e32f7babbb11801dca1729a18782daf07e3b6ac46bf3bfb1b97bf9b78230e012cbc18685a3290f1735fa450a84

  • SSDEEP

    49152:DUlhsJRZOTgkIpVtcY4WaRBKxKAl8poyCpeOfq:4lKRZOXIZHcBoMpopef

  Score

  10^/10

  amadeyredlinemarssoftdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1