Extracted

Extracted

Extracted

• • Target

    t5489145.exe

  • Size

    314KB

  • MD5

    5ebd49060b21946157c3340c680769d0

  • SHA1

    435b9e144da84d8ffa40b490d081e1d20947ee0b

  • SHA256

    b78d7453f75227abb897a3a573f08063b67661903605012881543f5abfd434c8

  • SHA512

    5b98f18c04011befd89dd2c24d3796eb010e789f72e20d651efdeaef03d9150bd4196bad70f359561bc9e58a22e07d712814e8ba2a5392e5ceab85c95d614015

  • SSDEEP

    6144:zR/tsQnf6X0M6+koYhXMxjwigfwfgbePu97rrAOQ322222KTq:zRlHVckoaXMxcePu97Hg22222iq

  Score

  10^/10

  amadeyredlinemetafileinfostealerspywaretrojanfabookielummastealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2