Extracted

Extracted

Extracted

Extracted

• • Target

    86a03378e03ca9b0abebd6dd43b9fbe079258a1c49c50f54f9c652b7dc618375

  • Size

    1.4MB

  • MD5

    2aa207059d1ecd650b1b8b6016884633

  • SHA1

    12f8f1229f6b175fb025a9345f580499e8c881fc

  • SHA256

    86a03378e03ca9b0abebd6dd43b9fbe079258a1c49c50f54f9c652b7dc618375

  • SHA512

    c1712c57ec5dc91e006b91e27ac5e85ee9a21c8b6c5e0580e8a4e74e7f8052774023a7aeb4ec550268fa899fd0eb05c0c5d767b6ce7229fddacc8317ee33ea19

  • SSDEEP

    24576:GSSiHK6p0vBTkeobJ/HaY8zhhQcRLWfeUwmwmIlU5G5CX0b:Ciqi0vBTpOJ/6YMhhdWfLwmhAb

  Score

  10^/10

  amadeyhealerredlinesmokeloadertucobackdoordiscoverydropperevasioninfostealerpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1