Extracted

Extracted

Extracted

• • Target

    83552710408b26c31af67dc0b42e97ae40b640d5d2537c82c9479086a6084bb8

  • Size

    735KB

  • MD5

    2b7c7887943a69a971756fe313d09b08

  • SHA1

    6d59ce09df65c13e61d215d75395fd94614588a9

  • SHA256

    83552710408b26c31af67dc0b42e97ae40b640d5d2537c82c9479086a6084bb8

  • SHA512

    4ef1deedd9b268da34f2c29428d908333afcb0f12af32b9a633288c6e2d5006920eeb9d316c4fcec6dd515253cd5fec7fb7ae6da9de833a7556f67b1927143ae

  • SSDEEP

    12288:9Mrvy90dlb9frbimBRXwAmmEGwwFIItZVBFwNB14+wpm2EsLj7:ay46mnXsNGwwuItZ6N74+6j7

  Score

  10^/10

  amadeyredlinededogregadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1