Extracted

Extracted

Extracted

• • Target

    04f61b5d30e82ea42a655fe84a17e42831dfa65cb8a4869d66fb350f05e0d18f

  • Size

    1.2MB

  • MD5

    1111b3eebf9629124528832d63d4191c

  • SHA1

    583ca2ddb1a204ebe7312cbe900334a7bcf3230e

  • SHA256

    04f61b5d30e82ea42a655fe84a17e42831dfa65cb8a4869d66fb350f05e0d18f

  • SHA512

    d1b86a1c4ec3d0b129d088a452fcf1d8186ab6ffdb4a323f947220659a9f286f570b2adff176c165579d8b44414c4514c8a1745c02e17fcb5ddab462e138003d

  • SSDEEP

    24576:eykTZ9WFijfQyz7Z9ls/pxWzmprVv9Yc5+Cn3dWoUfVCx:tk7WFijfDZ9uxWa9xxzA

  Score

  10^/10

  amadeyredlinegenaluserdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1