Extracted

Extracted

• • Target

    95d3dc42b78f3366fdc674898cfbd74936782282122ab.exe

  • Size

    1.1MB

  • MD5

    487c69f2ea223dbaf5160dd3148f5e79

  • SHA1

    36c8b7a38e66ea8bff2c83c4bba7d606302ab862

  • SHA256

    95d3dc42b78f3366fdc674898cfbd74936782282122abad67248d6711428385f

  • SHA512

    d496f4c9aae750e3c988c22636fb42240589274d36b0fa83a4737540b14e1331089db3feb0a7f94075e396841ff3a1d67844299160f54731c7a1b3c704842464

  • SSDEEP

    24576:MywjFb6sQbtkgurmsrMe7nx6SuXgD+3VX9t8IpKILS1Vt6h:7w/QxsKsrznx+Rx9zPAVY

  Score

  10^/10

  amadeyhealerredlinedomkadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2