Extracted

Extracted

Extracted

• • Target
    setup.exe
  • Size 1.8MB
  • SHA256 e9785a288816cb9d2d8a475a8d60fa34ca32ed6b0afb14b3a80c45f52b692f20
  • MD5 3b36ce6e95099aeeda2d1f41a1ab2ca3
  • SHA1 afbfc4467a04eb09235fd96db8c27180d1d96dc4
  • SHA512 f35c1d654221c26c8955498ac9e7043c4f93438d14eac4f355724365411ea8d90a1a452ab63d96c458383eeda53e3bb283b37b071ef5ebb738f84dc6d933436a
  • SSDEEP 49152:+jcEb1jDOWf6W/EI4Ngllj4ZUSQ/jYqK:+jcUDZB4N2jOWUq
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadey0657d1fed3aadiscoveryevasionpersistencetrojanredline30072024infostealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2