Extracted

Extracted

Extracted

• • Target

    5bbb5085d578246c117dd56527e7070b521c0ef6517c80be24b6899e05cbaaec

  • Size

    799KB

  • MD5

    535b075cf0bff237a26ce5596f7e9075

  • SHA1

    ac851f532830ff54eac50ee89b7ea37d879d4458

  • SHA256

    5bbb5085d578246c117dd56527e7070b521c0ef6517c80be24b6899e05cbaaec

  • SHA512

    8a72c350817dd88bc37d339821c2525885302f89af161c311891fff354f2c44265001a51a1035cf04359a9c05afd81e6c5d6ec717ac8c92d653c74727faa2bae

  • SSDEEP

    12288:qMrEy90/pRAXn+od8ZFLU8iUhjPo9BDZRqH2B3dn0t9Ptnt8Of2AKtzrMk3Fz:yy2an+seFi4Do9BHNdn8XrgHFz

  Score

  10^/10

  amadeyredlinegregamedodiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1