Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    788KB

  • MD5

    4ec009aced1f12f7d9a6a267d07763b4

  • SHA1

    898696448b7540b4921ca3ff088f111cd67f7cf6

  • SHA256

    e7b514d699390c69471df9d956c2d8b560c40f8162550cc40d5cf08bdb40fe3b

  • SHA512

    5810be0f7a4261f0cb273df39596d60415355aec5c9b1a2ea716e3089c4091007fe6153501d1717efe3a03e58598795ae91b4c3cf9a5ce5637b6578f0de46d0a

  • SSDEEP

    12288:djn18iQ2PBsXwuvPNEDohqXHFwFLz9/j/pizyRbVuID8RISSrXKQIK8KM:djn18S2CDoMXqFBpY/FOSSrae4

  Score

  10^/10

  amadeyredlinesmokeloadermatizbackdoordiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2