Extracted

Extracted

• • Target

    7b6cac753ef31aec267cf8bc6e961a0d.exe

  • Size

    529KB

  • MD5

    7b6cac753ef31aec267cf8bc6e961a0d

  • SHA1

    deb25674f39685523acf0070f1b5d79e155b2013

  • SHA256

    5b4c2b82b43bf011eed8569a0282968a5031803aea901fe2f1b6da0537879af2

  • SHA512

    aa4d9de15e043bc2f2618c4741c413785c119bd3e35652c11c9a5d90a087c9fa41f2abd82a7ebc02d376b89cc23482f2a832f279ef3be402c94660d602ea03ec

  • SSDEEP

    12288:lZ+A2fvXaRdnQgY8SnONV34lC7w5EzSTVr:n+AsvX82gYx24pyGr

  Score

  10^/10

  amadeyhealerredlinefuroddiscoverydropperevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2