Extracted

Extracted

• • Target

    515c26b04b1dbff4c65dcbb1e1a44842d3ed36d8b8ba08a9c9805d45bae4371d

  • Size

    390KB

  • MD5

    f6ded8cc3d5482dd0686323df4593d78

  • SHA1

    3910e7af66322656ed9a26e5e33e93d0e2bcdd56

  • SHA256

    515c26b04b1dbff4c65dcbb1e1a44842d3ed36d8b8ba08a9c9805d45bae4371d

  • SHA512

    7a4f1e0b9b6c020256117a9b122d95d7febfa9d1005572ecdb60b06655281a37e78f5c9fe05f553fc00d0b0d39c23d27500da9c445b3dfcf486c64a9d444a267

  • SSDEEP

    6144:KHy+bnr+Ap0yN90QEB6TtNAeqhjm+JCSScCWE36Zurq+2U+L+O6:1Mr0y90ItNA5mHvcCWE3+CgL+3

  Score

  10^/10

  amadeyhealerredlineromadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1