Extracted

Extracted

Extracted

• • Target

    22cb8a461c6a7887ee6fd5b26726f64002ce66908ad515e026a4df09d9dadaa7

  • Size

    800KB

  • MD5

    7b18c315606af8310da2f0e0e70f04da

  • SHA1

    5283a9cc8678d334932290c5bbe754c4b65e6741

  • SHA256

    22cb8a461c6a7887ee6fd5b26726f64002ce66908ad515e026a4df09d9dadaa7

  • SHA512

    412d6a50b3c789082001b4182d993bc03c0791573215fe99a48387744f8c3d60a456e105f15eca00714eaedee92fea6357c35381cd5eeb90125339861d52f9d7

  • SSDEEP

    12288:+Mr7y90RkJWt4bnH8Utn9lqBImSSuFp3GkK5/XVP/T5zW2Hy6OTyy:5yyTt4bncUSub3g5/hT5zWcOGy

  Score

  10^/10

  amadeyredlinegregamedodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1