Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    1.2MB

  • MD5

    ddb75b897acd2c4e681a55f303b34602

  • SHA1

    013c1690fe5d7cf3682e997a38a749854fb17f90

  • SHA256

    776774ccd8ce43f597affe3ea6aeda4edb187c2544b79f4b819de71e62dae948

  • SHA512

    ec72e49b003bf39040a151e2c3fb952b487ea2be2fc8c5ee6c85afd582f16a653cc8154c29cc0c95b3b4f3c2beee37fc25ac18ffb7a20113f457db20bc7d0c24

  • SSDEEP

    24576:wy3Jleyeg8/EU9LzqBll/0mVT7dG1DhiOi9Gc6cA7APv5mkxj:33reydK4/LT7diDg56cGmmkx

  Score

  10^/10

  amadeyredlineboomlakiodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2