Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    9fb83ad6d8c549b8067f68dbe5a4f8a8.exe

  • Size

    916KB

  • MD5

    9fb83ad6d8c549b8067f68dbe5a4f8a8

  • SHA1

    1c9da67bf16b6ac6a7b23623de45f3b8b33a39d9

  • SHA256

    1d6df5e2a42f4a61b60cf45a65897cdb1fe9b81958cb46d56157f58f574f959e

  • SHA512

    9c1c1d5614c57e650c843489c073b7fc86daa89ad810cbdce76764bb055b615f50fc794f79bc8543dd596bdc6b4ae78f895926711a29f5e9b057c04a3e702380

  • SSDEEP

    24576:FjmtwAOC4b6XFHHHHHHHHHHHEsy9pVrl2uN:cOC4b61HHHHHHHHHHHapj

  Score

  10^/10

  amadeygluptebaredlinesmokeloader5141679758_99kolyansuperaup3yt&team cloudbackdoordropperevasioninfostealerloaderpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2