Extracted

Extracted

• • Target

    d77468ced4761de4cf3a8bc3173591d650cef56ba9150adac6b94f3dace8cd53

  • Size

    991KB

  • MD5

    1ada88eddd3433359fdaa45633875f28

  • SHA1

    1f1bd4ab76e5399e761b27ec039b9dcd511ae2e2

  • SHA256

    d77468ced4761de4cf3a8bc3173591d650cef56ba9150adac6b94f3dace8cd53

  • SHA512

    51ed938a73e28b8171e7b9ebe5fec667f3e9d50794dc99579fc0e8ab7894c9bd49219e5c30f41abc3df074de4008a8f54d76da792e3796c25589f55e7df82e76

  • SSDEEP

    12288:1Mr5y90Ob2vErlfUy+R+g6Y2G2mf9vXPdAgEyqNej28fajJw9SC+rCCu61FmLPi:UyR2vwJCnF2G2mBfUNd8ahCvcYumB

  Score

  10^/10

  amadeyhealerredlinegruhadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1