Extracted

Extracted

• • Target

    a0668d4f54c298cfcf7ddf2b4f1b132ebe1e4d57a2c92653db9af7422cd54f61

  • Size

    1.0MB

  • MD5

    39c520312bd683e0330ffdc02b6dca81

  • SHA1

    1443d85eaa1a7d774e6990aef22891201c60e335

  • SHA256

    a0668d4f54c298cfcf7ddf2b4f1b132ebe1e4d57a2c92653db9af7422cd54f61

  • SHA512

    ebb64fcb7ddad13a510a3bfeda707eb38b863052ccf2fba03af9e35e3984a9e08cd1cf6337e4686a09654adb73d820ade3a67730f8e2f506d7feb083a2ecedf0

  • SSDEEP

    24576:FyPvCm9JFKRzBc8+OkLUQ923VbLICc/T4OPD6z+ZX3CFH7CCW:gymjFKg8mwQ92hLC4OrZyFHGC

  Score

  10^/10

  amadeyhealerredlinejordandropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1