Extracted

Extracted

• • Target

    7e8f635b8488863801bda838f35c9bb392cb43f5d5dd9e33d90e6999ba8d4b55

  • Size

    678KB

  • MD5

    6d80b27cb2e4da081f0f7f37e638d00d

  • SHA1

    dd0302d5924f4fea018faedbb0a44782dfa73c47

  • SHA256

    7e8f635b8488863801bda838f35c9bb392cb43f5d5dd9e33d90e6999ba8d4b55

  • SHA512

    50301dce4d7229e6c954aebcdbb04cbd70d0f317e6b45796b1161998777f75f3cc9b64b085d8638d9ab9fdb6d1d80165a9b2b135c1e7a3ee40154be9ca55d35c

  • SSDEEP

    12288:lztKekjWeeIOZ2alWJSn/ZmuFJjIH1PjOMvH7lM7XbOUqXBQ1W:lkueetn/0VX/7lM7rOUOBQ1W

  Score

  10^/10

  amadeyredlinefurgadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1