Extracted

Extracted

Extracted

• • Target

    fdc8c540b51900466fb7a68cff02d1ad.exe

  • Size

    849KB

  • MD5

    fdc8c540b51900466fb7a68cff02d1ad

  • SHA1

    07cfb1d89506e392ea4ebaf903d88800b5305a5a

  • SHA256

    d9aa69161f9b781e377776b06693794d1c74fb9c5d0e126f37556275b1821802

  • SHA512

    152df984421d06e2116d402335e3df8ea42e2d81057f59bed5315be63b16e3edc95810cc8336bbb167d0cdeabe626f24298c002ec4eca047410a8b4386f5b555

  • SSDEEP

    24576:wyzs1WL2sZiIvuc/67yD7KZwvUTZ/ToyflB:3I1W64rWCD7KZGIJP

  Score

  10^/10

  amadeyredlinemaxirovnodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2