Extracted

Extracted

Extracted

• • Target

    b0e423e6f8fffcc6dc50a2b81b15a196dda539487de309431d5f7b276e4978a9

  • Size

    734KB

  • MD5

    d3a57291534defb7c09fdabb4bd6b137

  • SHA1

    2bb939ff93faaa682909fc6338460532c1c882aa

  • SHA256

    b0e423e6f8fffcc6dc50a2b81b15a196dda539487de309431d5f7b276e4978a9

  • SHA512

    b1501a4e465b1d1f04c7d5a243d23fdf5458f9353d13088572eac2284f0d350feb5db4e2ecbe18b67534aa0f37322104e845babfdfed72a5f1fc6cd04edcd010

  • SSDEEP

    12288:oMrWy90Yoq8539PUl9HdCPE0Xkbn6snL9TYSHY4sQ+Cz/YXlvUa0hx0DSa:eyzoq834dcXkrbnL9THYPQR/YXiSWa

  Score

  10^/10

  amadeyredlinededogregadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1