Extracted

Extracted

Extracted

• • Target

    2f10c51f4bc74bf9f047506e204a81940af6667a61f9597afd84ba786f11fda8.bin

  • Size

    1.5MB

  • MD5

    cf9650610f2967c40ab675656ab7865f

  • SHA1

    67d04b1cb64e494d770446427f3d7bd28671548a

  • SHA256

    2f10c51f4bc74bf9f047506e204a81940af6667a61f9597afd84ba786f11fda8

  • SHA512

    f403861864c42ba6a6e74ce0376f26a60f0a4b1f1d0429d3d6f045d44e6feea7d2ebc9e9922426f3119df6887a7e4c9dc2e95d87143eb3600f55366035fce0e2

  • SSDEEP

    24576:9yHVIXmiDaEx+H3tmJv1jKij6yehv6c40q9RCIjd+3jNlBRyfyFqFmvEA9ABshg:Y1EtaS+XtOv17j6yU69THyrRJFgFqAq

  Score

  10^/10

  amadeyredlinegenalifeevasioninfostealerpersistencetrojanstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Redline Stealer samples

    This rule detects the presence of Redline Stealer samples based on their unique strings.

    stealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2