Extracted

Extracted

• • Target

    d2834fa972322f62bd9f84ab763de4f1a3f047e5d713255fef91ef17da392f8e.exe

  • Size

    508KB

  • MD5

    707c58d1dbfd454ec4fc46c717deeae3

  • SHA1

    e403877bc39370411de7d96ef6e92a6876d9faa5

  • SHA256

    d2834fa972322f62bd9f84ab763de4f1a3f047e5d713255fef91ef17da392f8e

  • SHA512

    e42b7afc9d0845b8e8657eeaba93ae5095f2bd05f750ccf6385a79f650c0333f972215ffe00bad461dd29ca018a91caf512bc8543bd59f45e23847db78638217

  • SSDEEP

    12288:ntOy03z+7mXpO8kFqKoAZlpPH17BoS4jBHQ:sy0g4O8pKowTv17VoBHQ

  Score

  10^/10

  amadeyredlinedrakediscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2