Extracted

• • Target

    f14baa1f7a6c9b89fb6e2e2410319c880b89e1e4d6b436d78e17abe4d647833e.bin

  • Size

    1.1MB

  • MD5

    7f807dd673ea76ac39cbbb9cf0870555

  • SHA1

    e479732ae2b1fdde9b383ef46be043791a0fdb38

  • SHA256

    f14baa1f7a6c9b89fb6e2e2410319c880b89e1e4d6b436d78e17abe4d647833e

  • SHA512

    3c45290d982a69602b3b52ebad2de6d7aa465aefd75deb55d60dd9eccc260f14e4fdae01fa557427edb3887c17a96f6c5bd1c850d7e1343a190e4ae966bb5035

  • SSDEEP

    24576:gyydYRc+JWv7gv5hBXSHM3UDpOhC2RJuWRhmqt:nyac+JbvZi/pOhCINRhm

  Score

  10^/10

  amadeyevasionpersistencetrojanredlineinfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2