Extracted

Extracted

• • Target

    35b2d1ae8e3f2cc4b229ad6a18006e6ac8a524d283ae2fde9791a62896b5e778

  • Size

    390KB

  • MD5

    8c19c1e9834370aa31811e019494badc

  • SHA1

    ab0b5af8af226cd85a584933c90d4428670fdc2e

  • SHA256

    35b2d1ae8e3f2cc4b229ad6a18006e6ac8a524d283ae2fde9791a62896b5e778

  • SHA512

    0423c45dd1608f626f4d5f7812c72a70e467c9e31d1392828f19052138ebfd5c918967e05bbc24ff9351601f7561edd18886897905b1b55fb430a6007179f8f9

  • SSDEEP

    6144:KAy+bnr+kp0yN90QExc78IcqGyF4tavFiGfYiz5ap5fcBO5CcHnlRHArAq2V1tWf:MMr0y90IwsnfYfacHnl96by1yIW

  Score

  10^/10

  amadeyhealerredlinenasadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1