Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    786KB

  • MD5

    5810ca3bf36ca38a36888a2f5c9328b8

  • SHA1

    764e0eba965e1aa22eaae4da46b5ed6778ff9e67

  • SHA256

    5939848fe5c91cfded4ac9b9d99b2a20d164ca45f1cb527e64d0571c98af48d4

  • SHA512

    49c4aa4abf00776579ca8e7045238a322e44c02a934900669ec1f2cf812bda914214a868f2adf6e9574d15777ac31b65833576da7c29611413401f22ca46694b

  • SSDEEP

    12288:sMrwy90bEPw4oRjVBykqq5rYYYBSrsAV81wPfwCaN6r6PU7Ufmd7Da/yEdO:0yYRXrxrYY+x0S6r6Psd7D0I

  Score

  10^/10

  amadeyredlinemaxirovnodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2