Extracted

Extracted

• • Target

    0a2c35de99465a628974217d1cf3f2b74c8bcd22f4982d24c169b6d8128d0106

  • Size

    1.0MB

  • MD5

    9722b4cfe2eaf61410685f674a82729c

  • SHA1

    c60ac71e7e7ee10baa1eeac3d0600cdfc5464775

  • SHA256

    0a2c35de99465a628974217d1cf3f2b74c8bcd22f4982d24c169b6d8128d0106

  • SHA512

    ea8440e35048d09783bd170dfae443759227cfabcb6fec452373d7de99043fcb22041e7c37dfe7a7937a5ae30afe150d5c0f3df3ad20f0bbdedffba58b0e6ee0

  • SSDEEP

    24576:ipyhPhgQzDuvp4TZxD16C5/Aj0cDdXE0sLG/O/9H:vhP/ApoxD16i/AjDd2Gs

  Score

  10^/10

  amadeyredlinenarikevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1