Extracted

Extracted

• • Target
    file.exe
  • Size 277KB
  • SHA256 20ef00653ebb1bb1c83536be60b700e6958b17ba21fadfcd1c1d7b2ad93cc2a9
  • MD5 2f3a3162c7aa84c091eb1245ee5b3584
  • SHA1 fe1a38dce6dd9b05b6b8fd9fa010facb274c97b7
  • SHA512 c620c893634ae17015ffceab725122a4e9405353c5ff127e2d7856d3ac2f35a48735abab7a76d9abe7e8f34a5c974433bc663849235b55f7f713b4b2b8cc89ca
  • SSDEEP 3072:rpKA/XMRfVBY/6e0rO22SIrPsHhPoDTcjR/4K239hWCI5iQeL/+PAWd12zjYtbvs:oYMTW0rZ2S+ghPofcjRtGhYxumc1N
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyredlinepersominfostealerspywaretrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2