Extracted

Extracted

Extracted

• • Target

    9faf7dd05baeee347014e49d14628e051614f172a265f7d716e8739c14404873

  • Size

    560KB

  • MD5

    8316514054866b36518117f05877f1b7

  • SHA1

    2516bc306cd8be38f07fc8dc9afd142216ef3d29

  • SHA256

    9faf7dd05baeee347014e49d14628e051614f172a265f7d716e8739c14404873

  • SHA512

    c24b18b3b2a733767e9e0eefaeaa86d699f9db4a93dfbce16bb618dc7937c9bd739fe3e0763b33c0151d69cf1dd8806c6c53f882def54fc9a14a7725fa6e1c7c

  • SSDEEP

    12288:gMrGy90fzM7aOzXGeKSp5yjtYsyftxidVcgeltZ:WymOaOujLyVxcaln

  Score

  10^/10

  amadeyhealerredlinesystembcdodgedropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1