Extracted

Extracted

• • Target

    590e0356bfc71a5abe89ede50c2cdfedce525022122d13ba2da923bca3651c28

  • Size

    678KB

  • MD5

    c621938dce3d62eed640c671ab411a7b

  • SHA1

    edc8d10052641afc3b24d94ae41892757815ccbd

  • SHA256

    590e0356bfc71a5abe89ede50c2cdfedce525022122d13ba2da923bca3651c28

  • SHA512

    368c2a6d67ffe72764395d031c6b57eb626794635613a74991250100f93535de5f4bd84a959fc10b4e53cd5cd64b74b1ea71c3a1770609579d7d9a7309ba6c10

  • SSDEEP

    12288:gztKeJjWeeIOFW6oWJSn/W3hXu013+y75kZSMuFW4dJH0byV:gkteeAn/ohXLZVkkMuPdJH0byV

  Score

  10^/10

  amadeyredlinefurgadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1