Extracted

Extracted

• • Target

    809d6248585ffe18b19cac2bea316863949008380a7201bf83a688fefc522d70

  • Size

    1.5MB

  • MD5

    2f0659746ba6d4ebcf25805ba7842886

  • SHA1

    133ebc5ec190aedf44a1b883fb0b667e4abf17fd

  • SHA256

    809d6248585ffe18b19cac2bea316863949008380a7201bf83a688fefc522d70

  • SHA512

    4286ce752e43543db76ebb71d94f749b2ba4d82a60e49b44614b51557966d9a930b5699596fe7ddfc59a0cfbcc54269c3d8e4e162eed1100c2fa0b38fb8ce16a

  • SSDEEP

    49152:VlfHhzsEmYKcHS2/vdKbpMup0nFdxXI9:3fBzsYKcHS6lwpMk0nFbY9

  Score

  10^/10

  amadeyredlinegenainfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1