Extracted

Extracted

Extracted

• • Target

    9ef6028dd63e09d7a1be0e4d115e2636e14051fc92f2d8c58940aad0543d7f03

  • Size

    583KB

  • MD5

    49932c0dfb5dba746f2d69b4154e419f

  • SHA1

    879835b1d875b0ea8a9b9c17aa604018b5bb93f9

  • SHA256

    9ef6028dd63e09d7a1be0e4d115e2636e14051fc92f2d8c58940aad0543d7f03

  • SHA512

    7963110aec2b8c8f76cb0df57446e0ba855638e792affc97f9293e03c6758bf09456d7c748177413f6e242167372ba69196657087d14c8dd09d24b4e179ed925

  • SSDEEP

    12288:6Mrjy90M54QZf0UPxwErgkSzZykke1Uy1FoOdKb:tyx5RuSglZMe1j1r8b

  Score

  10^/10

  amadeyredlinedanagregadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1