Extracted

Extracted

• • Target

    7ef92ac88c81b71b2f95eaad23367589f2451be1fe78ce04ebbb8ca96ad43b24

  • Size

    1.0MB

  • MD5

    72d3a2328e718dfb0c2a9f15e7d7cf87

  • SHA1

    caa323f32e0d9a04d49e2c05bd7aa9c6239d07d6

  • SHA256

    7ef92ac88c81b71b2f95eaad23367589f2451be1fe78ce04ebbb8ca96ad43b24

  • SHA512

    0d46b347477e2d9fe43e427ce17b4a2c9455c4538d850b47aa75d86b71927f88a8e3a463156cf33c5fd601446574c2591b023e6488f9f8434018a0a29f593712

  • SSDEEP

    24576:vyWEGvsqOYMwSH46xpcqnoD+9onL2KDkD+NMcfRx:6WEGvsRbH4acq02KDkD+ac5

  Score

  10^/10

  amadeyredlinegenaevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1