Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    877KB

  • MD5

    da2aff70a6794d258cfc5f3e30c3c931

  • SHA1

    57fa59d020b94f1e11a382f9393f7e68bf33ac65

  • SHA256

    bbb535e87b6d2fde49c6b143af1a003b5670b422937c9dd0cf5424bd212dfc01

  • SHA512

    46af5a92db5a223ed2a6db47350f5c448a25ad44e6e4a41da62bd2a7de3ba8bc47b85ea79b4adeb9beb0a1b10f0fce194b962e12ee1b63d99a79d5855f5fde53

  • SSDEEP

    24576:Fy7ThwtU2QVDbFXUnsQDcJHFJGY+qQGDq/OKWZf:gvhw+2MDbFXGXDcJHLAqxx

  Score

  10^/10

  evasionpersistencetrojanamadeyredlinesectopratsmokeloader@ytlogsbotbrehakukishpixelscloud2.0backdoorinfostealerrat

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2