Extracted

Extracted

• • Target

    d57352b17144065c6fd05a0807532115ba9622e99b096.exe

  • Size

    390KB

  • MD5

    03e5bda34bf1f1416df08c8f22f86c44

  • SHA1

    4da55b7cb2b7746156333ca9bcfb6b3884c95316

  • SHA256

    d57352b17144065c6fd05a0807532115ba9622e99b096ac4432dd312359b06d0

  • SHA512

    79aeb3c1fe6cce6505290ecf9f028d52fa101110737c79752aa852752cdeea568e22170640b9ad3f1156ee9768943ac6201bb11a873e85d7847054ec0357af7d

  • SSDEEP

    6144:K5y+bnr+Wp0yN90QEl2m2A34vRS5KRP5sp1BkXYijeIA3c5rtLIRva6:DMruy90734c6P2nMjeIA3cliRvf

  Score

  10^/10

  amadeyhealerredlinenasadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2