Extracted

Extracted

Extracted

• • Target

    0aca4b77d9ea6ea42d98d2aff881c1a71315bcebe3f8a946270aeb0f0a28a4d9.bin

  • Size

    1.4MB

  • MD5

    137528a7fb56dfa3ed5380001b2b9f01

  • SHA1

    4d1ce3b92e553de42c30aa6e3d1a8139b23fdd79

  • SHA256

    0aca4b77d9ea6ea42d98d2aff881c1a71315bcebe3f8a946270aeb0f0a28a4d9

  • SHA512

    3b19e371ce36875274e1ac87ff11447896b27174d1f875686cc2675efc4f2a9c19d79401a953ba31c05f7cee18bae999be86d4a1b96fccb1995f4c6ad5c72199

  • SSDEEP

    24576:xyxW8e7yeeVORat3AXeBCtX3WprHFsydCKR8yhOy0/YSGALvMv4Q+C:kxWvye0OstQXeBqHWprlVHwymYjAg

  Score

  10^/10

  amadeyredlinelifeevasioninfostealerpersistencetrojangenastealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2