Extracted

Extracted

Extracted

• • Target

    07906999.exe

  • Size

    578KB

  • MD5

    3902a9e7e0c84e8f3554cee142e8478f

  • SHA1

    5c1e9d48cef42c7655a2c197cd85bef983977498

  • SHA256

    dc9800714729a51a4d877748ad4b6a689db0603e0a21b389270b02fc0afede56

  • SHA512

    2445c5279c13ad0f08f93e81ab65d42b811c628c051bfecb34a7bddd574eb6c149e5098ed8b0069331ef1f09b34da968ee18a602f853958dbe93cd02b884b7aa

  • SSDEEP

    12288:5Mr7y90fqfizHQWRygf6/PcuY6FTajC+qFIdkRRn:eymqfFWRyg+jTb+qOE

  Score

  10^/10

  amadeyredlinecrazydastdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2