Extracted

Extracted

• • Target

    d00b7acfc68cb5ff4319f59b7748b38f83e5b6273216b79d1ad30ce71e15ab92

  • Size

    389KB

  • MD5

    583de6e704c7c868a6cb6e0181aae924

  • SHA1

    ef6c4e83fb0e41275244f463825fb383790a1501

  • SHA256

    d00b7acfc68cb5ff4319f59b7748b38f83e5b6273216b79d1ad30ce71e15ab92

  • SHA512

    05ceb88e50074502256c1cc98ed8781d31c2f916066ed66b06bd3e41ecb75c82f96ed394b3591918360a75f0cf1bd19a036d9f78c0cc57637f55e24ff0271e6d

  • SSDEEP

    6144:KJy+bnr+Ep0yN90QEYI0T9Bp/lGx7UCbMCb9XixyFjI433foJ+7QYJwolS:3MrEy90/0yWfC6yF73Q45g

  Score

  10^/10

  amadeyhealerredlinezahardropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1