Extracted

Extracted

Extracted

• • Target

    530177f4c0538fd5c0566e7c6b390adb.exe

  • Size

    591KB

  • MD5

    530177f4c0538fd5c0566e7c6b390adb

  • SHA1

    395be58bb0bcd73780175aa66b00c83999e1b7db

  • SHA256

    b7af1dd848338819a3f570ea5b5f09361e5dd9b8c4467a7e1a0a88f4e43d87a1

  • SHA512

    19b3a7a6a64c0e1c5dccbdd63648b2d1b99d8db70a779107969c87ca5558da174f6906ee8ae110cef0497882b964fc57e69d5b4d4ad284815183351a73885513

  • SSDEEP

    12288:OMrKy90GzGWF05HuPM1WIrM5h5I3Cu2EsaF2c8DRXGX2vco9zS+i:IyMe05H+M1zY5KCTLc4GXfoO

  Score

  10^/10

  amadeyredlinedizarovnodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2