Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    NEAS.8f4cdd6a29659cc23d602c48aa577070.exe

  • Size

    544KB

  • MD5

    8f4cdd6a29659cc23d602c48aa577070

  • SHA1

    898cfb68b584b10020f1e2b9c184f84b527e6f61

  • SHA256

    268542efd2ef7430be325a93d0799b34087b8c4cb1bd5f5c59e35550a02325ae

  • SHA512

    127e4403231cede8c8f31b123f0545f01ad0031fc3d026a68d3f19c417c892f80dd07c086e42ba7cff6f14d20b66b0363224b6318639b5a9d67ff50f47bacf9d

  • SSDEEP

    12288:5MrNy90N9RnRcSqG+dJbUOe4i9fIhGF1gCfN:cy495RuFdJUAiG0DgCfN

  Score

  10^/10

  amadeydcratgluptebaredlinesmokeloader5141679758_99brehahomedkinderup3yt&team cloudbackdoordropperevasioninfostealerloaderpersistencerattrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2