Extracted

Extracted

• • Target

    5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8

  • Size

    1.0MB

  • MD5

    9ea89321485e45e0673797ed4f7cb512

  • SHA1

    4a05bd2a3803851f46eaa1e0322412cb9c07bcdb

  • SHA256

    5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8

  • SHA512

    7715f8d6a052e371eac523483889f6209572a74296b9fb931c1e47fbe9109eb93612e8a772359e7659460329d10768f14627bd154b0ea46f114f824d6fc7e02e

  • SSDEEP

    12288:HMrIy90vBYLSv4/ZhkIBL3OKdwBqdjR/hk4ROuEIF1Z1OQAGtxc6jHLa932r7G+m:Xy4MfBqKd9jM4ROIF1QGtxDs32r7K

  Score

  10^/10

  amadeyhealerredlineladadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1