Extracted

Extracted

• • Target

    5f3cd8392c045a321ccf0ede6f38a4016a236f257d0a6ab897bf7f3e21868135

  • Size

    302KB

  • MD5

    a9502d407c7a3e0c43ad669c27638793

  • SHA1

    bf0b7815c6dac82643a5bf7bd397a6aa58a9e803

  • SHA256

    5f3cd8392c045a321ccf0ede6f38a4016a236f257d0a6ab897bf7f3e21868135

  • SHA512

    0dbe8772ded05ba2c67ea7a7e9bc291b76d8b73dbab86a35fca5b1138be41c2ee7a54333fcd7bf58823ab3b5f1f6250b98b829ca0c367cafb2176350f5454d25

  • SSDEEP

    6144:mJNMAvoYumDMaLVA/HmH6iWmL/M+VK0lNSOBYJ0tYRVxGGPTY:HAvoYumDHVA/m9WmLlVK0lNQHPTY

  Score

  10^/10

  persistenceamadeyredlineeewxfvcxcxcredential_accessdiscoveryexecutioninfostealerprivilege_escalationspywarestealertrojanupx

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Blocklisted process makes network request

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2