Extracted

Extracted

Extracted

• • Target

    2ccd357e94ebb0dbc6b4dc7d77247c08474593d983b5c9cfd191a2f8c105bc80

  • Size

    800KB

  • MD5

    f73478f96d098d501a5d5c6aa555b870

  • SHA1

    bc5fa90d2946a6fad64ca1b3b97799cce3a367da

  • SHA256

    2ccd357e94ebb0dbc6b4dc7d77247c08474593d983b5c9cfd191a2f8c105bc80

  • SHA512

    6dbcbfea3e2d0d85f88605bd434016a6344763059f31ead84745b53fc0d376f3d9f85eed08949381f1750b3b0de2e70e5f332c7a4a09318a41c0971cdf5c7b5b

  • SSDEEP

    24576:jyqC6My+zb5MCvcQTHSvUgT72OIDWJrDPJ:2qCYcbyC3Sc2IDQ

  Score

  10^/10

  amadeyredlinegregamanadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1