Extracted

Extracted

• • Target

    06a96efa7aafe049e6f5f3fa15c01a9c6651566659d1cf80a9b5d3e50389f805

  • Size

    1.4MB

  • MD5

    3fec82b51c6ec4b18e50462c5eb82fe2

  • SHA1

    fbdb9dc667bfe3458d59996586fe657e12755a61

  • SHA256

    06a96efa7aafe049e6f5f3fa15c01a9c6651566659d1cf80a9b5d3e50389f805

  • SHA512

    0439e6f1525cde443672501f17ca60b1076a03f5267c4cf4e94baaa01d0ebbf221ba65b7fd16e7f2d6158dc745decadda3f7e13f33d00dc2c473814a009a5788

  • SSDEEP

    24576:6yv13NZqYXoFlTrkw+KfkK/zZcimyHaYFpV0WWA9nrmRYYjjsLEhj/9CY6sgT/8D:B5NZBQTMKfkK/zZcimmFpGWzCDjsLwjn

  Score

  10^/10

  amadeyredlinesrutainfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1