Extracted

Extracted

• • Target

    79f94fe952dc449ba43b806fe15df3ba80e323c766ce98ab820f2b9c6d3976bb

  • Size

    1.4MB

  • MD5

    3b88c85021806a6f17260e4811a0a53b

  • SHA1

    a4a75bc7f6c7bc31c0aa7ac6c535efbfc0895a93

  • SHA256

    79f94fe952dc449ba43b806fe15df3ba80e323c766ce98ab820f2b9c6d3976bb

  • SHA512

    7235d4e5e0c5741cb7a25b1dc53ea24683a6f5d88b2532e944dc7683324476fa7e24cc3601a26f09d08c9dc00a8c10c8b45cd089613c50f33d5d165d78377e7e

  • SSDEEP

    24576:Uyxk3ur3HUPE7hbK8MTkoi9nG5AI8saJ1+tbWrObdokI9Ttkl/Zqdm6cfd:jx+Y3UPEtbK8MTNq/s4obGObdo/kzEmn

  Score

  10^/10

  amadeyredlinesrutainfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1