Extracted

Extracted

• • Target

    a7f449bc49be6f53213a078f41a3f1b222febee4a1bcb9c6d7f8fdddee03bad9_JC.exe

  • Size

    866KB

  • MD5

    eeacddb883c73f4e22781b88dbfb5b3b

  • SHA1

    a5d7426e70b412785d331fc96273ea4b1d987cc3

  • SHA256

    a7f449bc49be6f53213a078f41a3f1b222febee4a1bcb9c6d7f8fdddee03bad9

  • SHA512

    753a4758d6da1ab7188b70356c4decaa39344f6cd33b533b5d11c7e4ef564ec211f60ca94130f87fbfeaeea4db303cda4c90a8865ae6d1d1b67050e95b9a70fb

  • SSDEEP

    12288:YMrIy90jM4BLFyCmkb+iePQUprgyb+mfT/myMJdhSiG4gJgQLUmUPkerkxiexhik:gywMA4Cx2YUprfRfTOxDxQL/2kxieF5

  Score

  10^/10

  persistenceamadeyredlinegruhainfostealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2