Extracted

Extracted

Extracted

• • Target

    4e8ec1a6ebf6c4faf7cb2dfb4bd7aa30d3c66478deb107376900a4c9b0a744b9

  • Size

    786KB

  • MD5

    7a290ca4e9970f72f4e229756e58d49f

  • SHA1

    263e0583068ea98db25d7a191df1a8ef0131c944

  • SHA256

    4e8ec1a6ebf6c4faf7cb2dfb4bd7aa30d3c66478deb107376900a4c9b0a744b9

  • SHA512

    ba0697aa22f517404cfda8a142bba98c52b8e0a38ebc3a3345b403fd8db0e21c86aa7a236c6f3f98ff18d69ef3b5b9a87b3ea7e80850e3f7827adefe77717a18

  • SSDEEP

    24576:KyqwJgcfMCajAo3RlRZGYDdUzjmcncKAae:RqwJgc01T3lZPDWz6qcK

  Score

  10^/10

  amadeyredlinejokermanadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1