Extracted

Extracted

• • Target

    x1211546.exe

  • Size

    323KB

  • MD5

    c0139aa4e53199f6a43f1b6dff36baef

  • SHA1

    47ac9829fab0a03a7c9432fe1e5ec76c0b13c36a

  • SHA256

    ad5bec47b6288d6709aa23c8c79a3c77f7667ee8b7451b2fc8a143a0bbcf604c

  • SHA512

    d4bebac96fae9048777e7c19bddfd9530a2d5a1ea0d000f23999788daa4377ccb5745eb6e4e4d1fc866026320af8cb21356e36fc08e9241498317741b8664e39

  • SSDEEP

    6144:Kxy+bnr+2p0yN90QEhN/J2E2DP2emQlmfK1LBcFxJr7v3gbq:bMrGy907N/qDOemQlbJ2zpfl

  Score

  10^/10

  amadeyredlinesmokediscoveryinfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2