Extracted

Extracted

• • Target

    4058bf9d95b76e3273d98cd65e5ab1ec8a800396d57420adeb084f0b76fb43d1

  • Size

    390KB

  • MD5

    a110640e768195fc4e55e51a3850d57d

  • SHA1

    f2b8a43e9c4f8e5a4476f02ec5da091728775c61

  • SHA256

    4058bf9d95b76e3273d98cd65e5ab1ec8a800396d57420adeb084f0b76fb43d1

  • SHA512

    c041c77354db41855abefb8d646c3f0ebd93b399b6f21854612bdb2bbbe23f78b561b0aa0642768bc9bba05a9c804cdb5b42b23571ee834d47b70d31ea6ea5c2

  • SSDEEP

    6144:Key+bnr+Jp0yN90QEqgmEVVvb46L6hGlYgp9aFPngAowjp/xTrhMGtvNxgV:+Mrdy90c4Mgp9G4+VJ3SkgV

  Score

  10^/10

  amadeyhealerredlinenewsdropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1