Extracted

Extracted

Extracted

• • Target

    d2288a2a20d98d0532bfbced9f29d8103dae7d7759c740b5b229634c5519f7d5

  • Size

    584KB

  • MD5

    366b6261442953960a7aca3dcbc087d1

  • SHA1

    9007948842bd61785e2bc0f55e493a16c9811749

  • SHA256

    d2288a2a20d98d0532bfbced9f29d8103dae7d7759c740b5b229634c5519f7d5

  • SHA512

    0525d273ea509ee96013d2e25363cd132ebe1fb451905c6e37064be5a72b8d329e927983a157342b582a7fae72a5a33596e8fe6e3715a4c5a14d18934b5acb24

  • SSDEEP

    12288:xMrMy90AniI78jHpZobYG1A60WXWiXTeFX1GSlU75U3:xy3n8pZob11JrXdCFX1rC75U3

  Score

  10^/10

  amadeyredlinedanajokerdiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1