Extracted

Extracted

• • Target

    54110f38bcdd48a812ee858efdc3d1db1c2ba162c1cc6f6d533a39dc2eea936f

  • Size

    1.0MB

  • MD5

    0446680aaad5c87c2f4dfc95accd280f

  • SHA1

    a12637ea126becf6e989775b522eea6166be3968

  • SHA256

    54110f38bcdd48a812ee858efdc3d1db1c2ba162c1cc6f6d533a39dc2eea936f

  • SHA512

    cbb719c814185b2488edcb55b2a2f8064ebd51c05d52a1138e4fe6ce9eeaecd9660c9c08f1394597cc7b2062d206400d04df86398620a75dc89453e564139ab3

  • SSDEEP

    24576:wymOAy+hOTz3qiYn35+mFqnoGrctwmtdjp3BkKzD6:3mOE4TCnJ+aqrcrjpK

  Score

  10^/10

  amadeyredlinegenaevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1