Extracted

Extracted

Extracted

• • Target

    a9ae0731cf44498c5e828c76a3b5c92b1cdc95fd0e2511ae2a239a562a603147

  • Size

    1.3MB

  • MD5

    6016878f54a3362dd146fcc09b55a812

  • SHA1

    9685b581dd4c1d54f424af3a1cdb5a33e121ffc7

  • SHA256

    a9ae0731cf44498c5e828c76a3b5c92b1cdc95fd0e2511ae2a239a562a603147

  • SHA512

    916588f0ccdf1588dcd552ea159b9dbcd80981e47a5d62b848c1f1d431a8be8d5af8701675afced45ece0657dd41d05f742f1390ccb43451a618721be52f79ef

  • SSDEEP

    24576:xybBCXdtiwhFf+fMfG4A3aS0v1mKbQFRgGQldqZCQlOCX:kbBCXL7buX3gVbeWbly/

  Score

  10^/10

  amadeyredlineboomlakiodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1