Extracted

Extracted

Extracted

• • Target

    ca746188c1368388ef76747a4271de9ca319db1a6b288509ae21c656f5654c93.bin

  • Size

    1.5MB

  • MD5

    a454ab8bd67302235473de5eb0764052

  • SHA1

    d60236d42f45263d3b2f0ab2bf659a1aeba9a4c7

  • SHA256

    ca746188c1368388ef76747a4271de9ca319db1a6b288509ae21c656f5654c93

  • SHA512

    c58fc33599b95a3cd1043a69391d112457d11f06bf238c840517c21dd1e4f7cddbea7c2b1bdfca4e1f8a24275dfd0161b8b45bd4ea72e6de3723fbb4e4b750b4

  • SSDEEP

    24576:NyWC/qKjmI1b/ptBUmORwwQwthUatpTfgjWjEjyELJ4RyrqFmIj99WARy+:onqKjmItRt2Pgsntpyfrg/OU

  Score

  10^/10

  amadeyredlinegenalifeevasioninfostealerpersistencetrojanstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2