Extracted

• • Target

    eb7048680a096902e0382f96ee2074c5313d6646b5e73b5d1c61931d01e857da.bin

  • Size

    1.1MB

  • MD5

    790ccd48e6f5f3857c6e0891b7c03167

  • SHA1

    cf4a097731770305d973dba828067c8b9e9f652f

  • SHA256

    eb7048680a096902e0382f96ee2074c5313d6646b5e73b5d1c61931d01e857da

  • SHA512

    22adf4104fa4704316ad27b9a5c41406336d730f556da0db754a976e7c0f4bfeb9594ace553a662f7b34054710f4143711ea3e35bacb3278bbd9c7189eb5a28f

  • SSDEEP

    24576:GypxeX9vM6bw/AL4xQEV9COwaTHC4on00B0Gyg49fb:VpxetNc6kHCZaTHTon0PTl

  Score

  10^/10

  amadeyevasionpersistencetrojanredlineinfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2