Extracted

Extracted

Extracted

• • Target

    a86647b6fae82a1e4cd9344fc4ce634c013f7deb0afba0a6a92b475f9da29f59

  • Size

    239KB

  • MD5

    bd587a0b585165344d260012871e1f30

  • SHA1

    9bd92efd55b61b8d12c8d910a2a71aee125aa6cd

  • SHA256

    a86647b6fae82a1e4cd9344fc4ce634c013f7deb0afba0a6a92b475f9da29f59

  • SHA512

    791a5a938ab6ec4553d2cdf3f7f9a7154311a94c5ea055ea36c3418f26aaacc89b2ea0e203085a4c9f57d380daad1465d9f0a3ef6b6a3830abb0bd3c27ddad7e

  • SSDEEP

    6144:V7Vj3uVUn27+6qQx41QPF2nnugMeS2SpY:xwYfQx9FOnugMeS2

  Score

  10^/10

  amadeyhealerredlinesmokeloaderbrehabackdoordropperinfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2