Extracted

Extracted

• • Target

    7d84e0aa0d09425ff3ef23d6a01dc8c8e709488dd4ebfb66d005d00c96b56636

  • Size

    936KB

  • MD5

    cea83b418dd632977bc71493b6a7616a

  • SHA1

    f868454521eca497af6c4d7d05731d94c5402a69

  • SHA256

    7d84e0aa0d09425ff3ef23d6a01dc8c8e709488dd4ebfb66d005d00c96b56636

  • SHA512

    8e2e4d3136abbca50adbceac3f5e9c7f8e06262892ecd3e51908c3f1b2f827eec6b6b854a0737cac7bf09e28c25790d06ea0ed9b6fdd46057c9534cc8513827a

  • SSDEEP

    24576:ByVFL7CF8CLGT805b0777tO7U7zGcslxK:0VFL7CF8eMnl0JFhsl

  Score

  10^/10

  amadeyredlinenarikevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1