Extracted

Extracted

• • Target

    66ae3e3d68b3c0288447e7a8ae43d9017e45b19f2f3e536eead29f34dd93cade

  • Size

    1.4MB

  • MD5

    9af31d04ee5baa83455dfe84f665bfb1

  • SHA1

    d2b54c61b750d0326019318f4937277c2ca14f29

  • SHA256

    66ae3e3d68b3c0288447e7a8ae43d9017e45b19f2f3e536eead29f34dd93cade

  • SHA512

    ae31f85c3a6a42dd382781298c41aa5670f22422944c37234545788cbda019048801d5a3b38f72a2f3f428e772cb20bec8e5d60b124bc95f1f5ed0a538667c27

  • SSDEEP

    24576:cyKf8ssuQ9MC8p2yOb4MIEK6OKEErwi5UydsBQ3xie4p3ALm5Hmz0/jl3Rcpq07l:L2pQCC8p0I1pKEErvfdF3x8pAm//jlh2

  Score

  10^/10

  amadeyredlinesrutainfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1