Extracted

Extracted

• • Target

    JC_839b0cd356da0a1f8517d491f51bedb263f65675b3c4e8db9036ea7fc623edc8

  • Size

    1.4MB

  • MD5

    0c9e12dc9554ad954579989feb642ce3

  • SHA1

    e228f547d3bda784d46b8fdbb154d4825d9567af

  • SHA256

    839b0cd356da0a1f8517d491f51bedb263f65675b3c4e8db9036ea7fc623edc8

  • SHA512

    47e9eac68b09a5ead14faa6021aa41b2353121bce2c2907e6f2ac138ec57b33e95678289b612e76bebd47b1b345c394314574dbc0e7857b2d56d2661681affa4

  • SSDEEP

    24576:fyzzwr26Y/lhZhaW7iPKQnbpyr3acxl82LsS8orLpUitvyOV/F47EPmtiRdLG/3+:qzzU2DDhaW2PKQnbpyr3hWSsSFiitvyU

  Score

  10^/10

  amadeyredlinejanginfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2