Extracted

Extracted

Extracted

• • Target

    15a30ede5d7b74aa0747f5272eb40be7f3b18b5ab5015c8ca1d03d5da554e4d9.bin

  • Size

    1.3MB

  • MD5

    51f8c397946d62a729e8dd6048d76a5b

  • SHA1

    4873b4bd4810abcd174a54ddba5d952daca31d90

  • SHA256

    15a30ede5d7b74aa0747f5272eb40be7f3b18b5ab5015c8ca1d03d5da554e4d9

  • SHA512

    e998f78f01df4d50219d940c60d2c1083dd91e7b3850df69952e8c73cc2e6d56086cd295b4d6d69e8215a7f6b8a06174ae45985f7914c7db530ae871e980b9bb

  • SSDEEP

    24576:my0SivRvz63xtTbbTvHnkDtjYk0aCxGt2+O+qNCwaNG3ZCfjIjh3Ii+YaVfC2:10S0v8nvitkCIGt27dN7KliGVf

  Score

  10^/10

  amadeyredlinegenalifeevasioninfostealerpersistencetrojanstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2