Extracted

• • Target

    dd6fa09156b2148e80353ca6a9b3868a9059c8adbb7cae5755ecee62b08d8db5.bin

  • Size

    1.1MB

  • MD5

    ea61842e38fb75bae866b2523ceb0b3b

  • SHA1

    3f48701e7cc94c4e6143a83882619a8da9401870

  • SHA256

    dd6fa09156b2148e80353ca6a9b3868a9059c8adbb7cae5755ecee62b08d8db5

  • SHA512

    a6ba55ffd8c0e5643faa79d894c86b495df57f8adf1e9fe36751073a47cd172f9fafd05ec6403b0b94c1fb60964e1b5f698e3e11bfde5430d7f026ce1a5f6b0b

  • SSDEEP

    24576:vyppOe+LnMTZhuR6C7q0NWNKfehJgL9ZTgp6qAzq4TGO0:6rOniZhI6wqwWNK2hJgZZ0p6qi3T

  Score

  10^/10

  amadeyevasionpersistencetrojanredlineinfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2