Extracted

Extracted

Extracted

• • Target

    9fe27d7a6f4f7d8c1d91ebb21e931d979b87337258cb25a1d39c2cd214d8cac2.bin

  • Size

    1.5MB

  • MD5

    c73984d3b7230c8513fc05de56737372

  • SHA1

    c379b21ca7a895375906f8912caa29a489a6836d

  • SHA256

    9fe27d7a6f4f7d8c1d91ebb21e931d979b87337258cb25a1d39c2cd214d8cac2

  • SHA512

    5b1ff33bbd4e941b1589bb8682361e6dc9eeac321815be630d5c29b285ac3e5569c3d0df23fc0372cd5bd0c789ae073967a85c49850dd7ec93a89fba264cd422

  • SSDEEP

    24576:Oylucou2kFNKfcUDlKZeDttKuuH6Pwk8gT4RXNwzpJhqfh0hZKf9jEkqy:dj5TT6cvZst4Q2gzz5qZOIfdJ

  Score

  10^/10

  amadeyredlinegenalifeevasioninfostealerpersistencetrojanstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2