Extracted

Extracted

• • Target

    13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1.bin

  • Size

    1.5MB

  • MD5

    2e667dec3dea82de02ed6b0d947672d4

  • SHA1

    025e2c59034345a5c86acc8b04f70c0eaf82ea56

  • SHA256

    13e3c6035c96bd9450691877aa68c9e02c5179e3a0ed7ed998b53f67735931c1

  • SHA512

    2deb511ba513f4ca97639eed541ef73045fcdbb25b3b2ee51904b7d07c5aaec2f87cf38191ace33975e2bb9e2452a6eb92dedb2d4e4f9c5521a43bb9f920661a

  • SSDEEP

    24576:wyUhKIa1M21gfKXfxEXf4tuDZy7tw+QiOrekk8EOBobGV8fg1uMKPeGOxmjys3kC:3UKIOAK+XQtYo7trQiOreYPoqVyg8MKS

  Score

  10^/10

  amadeyredlinelifeevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2