Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    file.exe

  • Size

    876KB

  • MD5

    b1ff7dddecb23ab890127b9aefc2b1f8

  • SHA1

    219faa9f45f0f9c43fe88e78c06499a4634ed11e

  • SHA256

    9f11c43fba696b3cbdd3bfb88cf172216e616cff10a392676e7ab8a25ea8a7d3

  • SHA512

    9211272f463b1a320fdee0d7dade4c300c08026ff2fef179b3f83cfd3ea96241924f44186e96c67328f31185a833364f071a56124d459121c49c4fa06f789045

  • SSDEEP

    24576:AyFcrqibnujUGx9WAam78eqJ3MevoCH/QNtk:HFqqoRGx9jkJcR4/QNt

  Score

  10^/10

  evasionpersistencetrojanamadeyredlinesectopratsmokeloader@ytlogsbotbrehakukishpixelscloud2.0backdoorinfostealerrat

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2