Extracted

Extracted

• • Target

    a1d9eb570101fa71892c1b158b98808be8caf81f183dcd3880e2a3354af2ba21

  • Size

    1.4MB

  • MD5

    7469ac69ab79ee867a0d1a54d9baf8ca

  • SHA1

    2be3a959c0fdea041f2cfc3d12394e8913b82c85

  • SHA256

    a1d9eb570101fa71892c1b158b98808be8caf81f183dcd3880e2a3354af2ba21

  • SHA512

    0b5d539d9e4bd9e0d940593ae10f0c494f54d1f5da39fd02eca888b60337d95c84e61d7d6ecfe6b1834f3ecdf594eebe17904db2fc2e886871395808393bea82

  • SSDEEP

    24576:jyCPB+GFQXhCuj7j9KyKXT6EHKuHpUrpK5QcJshvXOcS5A5OePfQ3OYj86a6g:2kB+GyhCuj/9KyKXeZbiBMXOc9OIfwP

  Score

  10^/10

  amadeyredlinesrutainfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1