Extracted

Extracted

• • Target

    f88e345b72d2eee5c12d7ffb5e8226389934fc3a8fc7d2c825a409f69c7391a1

  • Size

    390KB

  • MD5

    bb828ebdc9274ef826c884c8492dc9d1

  • SHA1

    862680c784222b4796cfd2400ad767250b6fde26

  • SHA256

    f88e345b72d2eee5c12d7ffb5e8226389934fc3a8fc7d2c825a409f69c7391a1

  • SHA512

    fbf61f65fbbeef869591c148bee1026cf15dce28f25b67daa2a53b44f40b56cd691a88659d3439736ef5e3478d0b9304224180b63ed75d0cda57ae866bd0fba5

  • SSDEEP

    6144:Khy+bnr+6p0yN90QEGv8/fIA+oiht8P9snmpC97tos5d5YQc8REcVjOlYX4aFtYo:LMrCy90Avdtbcmm0uhRlwfL

  Score

  10^/10

  amadeyhealerredlinenasadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1