Extracted

Extracted

• • Target

    4e4fc1a7dbfc98c5f6dc1fc8d83b85c66fe9da4509be4642e0f140ff45c9128d

  • Size

    390KB

  • MD5

    6433228d1e2961f0fd45fb222217f429

  • SHA1

    73d0b2e499696621f36a99343b77d6ca89acd023

  • SHA256

    4e4fc1a7dbfc98c5f6dc1fc8d83b85c66fe9da4509be4642e0f140ff45c9128d

  • SHA512

    2ad6fda6f4a2931e5c6fc6fb5b79a99c5afa54c9e6e7cd0ee46a5936db09323600aad513562af4bd9d1a373827759ba47daf90c525d6f217a7b50c471567a0a3

  • SSDEEP

    6144:KDy+bnr+4p0yN90QEFOSk9dEkWn7ZNUPJcxJ6EH7/dzbER7Nf/CcHnlRHJ40GXJa:FMrIy90jTkf7GJvrpEzicHnl9mbiS5k

  Score

  10^/10

  amadeyhealerredlineromadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1