Extracted

Extracted

• • Target

    baa596af972a71a6dffd1887cc066407e8e389ec0ce927ae15ba0e1b45d6bdd5

  • Size

    713KB

  • MD5

    d9777f3c246e7100d6d021065a053475

  • SHA1

    a748582b428211f264568fe8dcba03516d3d3f31

  • SHA256

    baa596af972a71a6dffd1887cc066407e8e389ec0ce927ae15ba0e1b45d6bdd5

  • SHA512

    6dfd2194461a910b00aba0f1660b8ac03a7710ca2ac24bfd7f7e3464981063ecd2984214a90828a697b605ddd75589957092bf1f5b7b7a3c7838dbe9d7697158

  • SSDEEP

    12288:pztKeZjWeeIO5zyMWJSn/zw8z2Aggjdfulz6a9018z33XK+F1LTn:pkdeePn/zGgxWlz6a9lz3VXTn

  Score

  10^/10

  amadeyredlinefurgadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1