Extracted

Extracted

• • Target

    75ab678257f66e16102a10bd327459f3e7cbd415643e872451575ed98bdbd1dd

  • Size

    490KB

  • MD5

    e99edf5692b8b09346ff6567d59335ce

  • SHA1

    8b5de1328a181fef83f917610543216d87260203

  • SHA256

    75ab678257f66e16102a10bd327459f3e7cbd415643e872451575ed98bdbd1dd

  • SHA512

    d13f84c858a89757a8786b1c5f0d1df05f87c6f84510dd82630a8a0da98cd08b952cb038531aeed81ae34a6d72d14114c641683e97e2907a30979650440433b1

  • SSDEEP

    12288:/MrUy902sgSaHY24MpMaFdcWcWvYwUrT:PyzOgY2NBdczw2

  Score

  10^/10

  amadeyredlinelampdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1