Extracted

Extracted

Extracted

• • Target

    a96a86dc615b839155c86b970a5966756bda947843358946503221da67e50030

  • Size

    1.0MB

  • MD5

    ce0b47061fd92fc8be9f8c9ea55547ca

  • SHA1

    87ce261931eb5df81a34c00c27c2adb3b7a1a670

  • SHA256

    a96a86dc615b839155c86b970a5966756bda947843358946503221da67e50030

  • SHA512

    9d421d2993f037661aef8497b644eb1e7b0cc932e93f6ad584836c1a037491e15ec7df84e5306bc8a3c78014aae9e845d94450d33e6e25d2ad92c6b5acb60d9a

  • SSDEEP

    24576:SyW9VOVqxPBtfKjzMcRvmtLIdnWmS0cnmVB+8yX:5K7xPBd6RetmnWmS0cnmjh

  Score

  10^/10

  amadeyredlinegendalarekinfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1