Extracted

Extracted

• • Target

    302089b6d915ee7a7b11ee870603c3f91e879fb9662469361f44c18ea7b521f5

  • Size

    924KB

  • MD5

    4da8e4efc004ba2589e87626c23cbd11

  • SHA1

    daa047c054a2a163b821b188b4c66226e080eddb

  • SHA256

    302089b6d915ee7a7b11ee870603c3f91e879fb9662469361f44c18ea7b521f5

  • SHA512

    64496e4186c174981c3fdf286d3d8b28d2518c66991e131ed5f921d35a6623e6dda3ed53e59e3461c77dbaafbc3aafb2abf456760e1871d13e9dd79ecb559445

  • SSDEEP

    24576:TyJAPYJnhDVbsm3jcjQsIHq+6WV/pwUeKyc:mnJnhDVomzzqjWV/pway

  Score

  10^/10

  amadeyredlinelupadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1