Extracted

Extracted

• • Target

    25e6f1a7b7ec22a50c69961dc66927f89c5de36c14a5b8d83204b2c0e6d49335

  • Size

    704KB

  • MD5

    eb8d418f1364ffed2a31c0c4219e5d65

  • SHA1

    535cf2218fa2065020413ffb03dd4d91f1ae4c36

  • SHA256

    25e6f1a7b7ec22a50c69961dc66927f89c5de36c14a5b8d83204b2c0e6d49335

  • SHA512

    41f455c84778434ff6c390af688d326d965d3ce733d5a4c7b7c562eabe3cc373be04e81f77ce5f239494bef74e888f61807445728f696d983430ac9c1b4efc4c

  • SSDEEP

    12288:fMrgy90L6Bl6zbmpYaF91DtnwR52csWoUCLlzwF+w0CTORQVEsg20GJZdET8:3yIcgBaX/IYKoUCLlzCTtVEpTGXdET8

  Score

  10^/10

  amadeyhealerredlinesrutadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1