Extracted

Extracted

• • Target

    dc2ff620fafd575e877ceec0255f4e45c0a42262494cf828cfd95b9b03388a31

  • Size

    1.5MB

  • MD5

    5f9e63419467b981b72d4f9adbe67d22

  • SHA1

    420ec23d6870b000adc0eeeb60868a9cf7383e8f

  • SHA256

    dc2ff620fafd575e877ceec0255f4e45c0a42262494cf828cfd95b9b03388a31

  • SHA512

    1c633bd4f637d5eaa27c003b9565ef85a32009c40e2c33c2f6e01be35ecd3ce14520e3ac230c787fc39cbdf148b09b34f74b890c3f45593acee72a7c624c6140

  • SSDEEP

    49152:1Ls/ZE3GjEnAXnG7fkG7NvK41vG8ZfEnf:da23GjEnAXtGQOOvf

  Score

  10^/10

  evasionpersistencetrojanamadeyredlinefrantinfostealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2