Extracted

Extracted

Extracted

• • Target

    0f262f199604439d6389ff38b9d5f3827e0706fe6a3735dbb5d32121004a6ffd.bin

  • Size

    1.4MB

  • MD5

    13c42fd7e6c985f3ba9427fa4f1911c5

  • SHA1

    19b2f7692854212090a42f535f2ceaee1995bcff

  • SHA256

    0f262f199604439d6389ff38b9d5f3827e0706fe6a3735dbb5d32121004a6ffd

  • SHA512

    24135d248e927dcc63604b51e2b2589f54c5d496d0697e72a45c89e7b94b8e8c9299cfac4addaeabad286e32767b75fd1a1e85f205999f5bde59d81be995e88d

  • SSDEEP

    24576:NylF8cwSngUAT/e1teYL3HBg8+E5X7XrCW3xIsFw4IB9dMCjIliGbxeBObK5TAvV:olNwqgUI/QtBL3sE9bCiRFw4ag8oK5S

  Score

  10^/10

  amadeyredlinelifeevasioninfostealerpersistencetrojangenastealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2