Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    explorhe.bin

  • Size

    426KB

  • MD5

    9a0b7ee713610b8395c8f0580a3b1e3d

  • SHA1

    e44a9e7ec6fe06ae6ba1b9518db78e95ad451942

  • SHA256

    6b8e428cff996c49aa52e017213c7016880a2bc1583d051240c74992bf83c357

  • SHA512

    0f7acbc99ef4b91eba1db5b50a352f29432da25bbd3c4364947dad3d1ce2ccc3b9f95f75e66a22cd11d7fcd8bfcc6903ba646b2e8543767bce4b6b786736f8fc

  • SSDEEP

    6144:1OP1cLnbZQOvBM1nGT7SVJEeFRuhuRlOBC+3hmHfqYr5PcfT5m0JuGeFxACt70+N:cPkOOKGNeZ6C+RpYrtS5m0JuGeFxZ06

  Score

  10^/10

  amadeyredline@pixelivelivetraficdiscoveryinfostealerspywarestealertrojanlegaa

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2