Extracted

Extracted

Extracted

• • Target

    a4d029c16a20b17a69e336b33ff188537438de0085cd7ae2f569966928478a25

  • Size

    582KB

  • MD5

    bc8760f1b9cf3961edd1ca06204b2622

  • SHA1

    44e35a386df70385cc1ebf46f2b92412695fac9f

  • SHA256

    a4d029c16a20b17a69e336b33ff188537438de0085cd7ae2f569966928478a25

  • SHA512

    1f35b829606f7e53f654d54970891e82b9052ad61ccb00ee8b2e51b04ecdfd7448b6f37260013f94e56676fe440cdd6af010792468d4804844d5bcea6bdca0dc

  • SSDEEP

    12288:RMrMy90rmYsUQ5br4oopTVU871W9Jl91xe1tpp3Zh0ZZsGSharYLa1l:xyvTPopTVUy0eTbJh0ZZaa1l

  Score

  10^/10

  amadeyredlinedanagregadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1