Extracted

Extracted

• • Target

    3d90cae0a0cd20c3e25d043063a73fd733024a67f893ab64f2b442146b28e482.bin

  • Size

    1.5MB

  • MD5

    03a823d543a273c57b4056e8b26993c7

  • SHA1

    99524482a8eaec519f61652fc0cd52fdf2a8dd59

  • SHA256

    3d90cae0a0cd20c3e25d043063a73fd733024a67f893ab64f2b442146b28e482

  • SHA512

    3caf9f399a50ab96abcbc6cd66416619922761d4b385e0fc1a2466162603e9b1c693ace7c3b2c807dc2f3cea8f3eaca03fd8988fdbb0d1797058f368314eb602

  • SSDEEP

    24576:myyOffDEC4u5WqtGtqAO4etgiioNEOI5G+DNVhzIm8tcTTfiM6D8HxGxOY:1dEe55tUqANeWiBQpNIl6qM7C

  Score

  10^/10

  amadeyredlinelifeevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2