Extracted

Extracted

• • Target

    ac1cfd6ba1d5f8161cba3a62b48fa3aa19a6a9b027ca6be2c9fda24e61f7bf4e

  • Size

    926KB

  • MD5

    26a597cc6fbc44fac145c2595e26dd98

  • SHA1

    3efb5e3da8de4cef6f15280c094e917eda503932

  • SHA256

    ac1cfd6ba1d5f8161cba3a62b48fa3aa19a6a9b027ca6be2c9fda24e61f7bf4e

  • SHA512

    8dd9be085e1337b6e4490be56b863b5ba3ba094b20a300b05c256d26cffd608e3e57109703dd50774ca41a20693429069416ed2d41cc97f0b8d95c1558751698

  • SSDEEP

    24576:jyJiCVkkfzRJwO1gmDtnjXeV+NBpgk/ZTxYj9B22:2JiCV9fzTw8g4nS0NBpR/ZTxu

  Score

  10^/10

  amadeyredlinelupadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1