Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    160ad15742e34779c030c0736a6a61dc2b85ff7a2341b2c82cc8e144c9019384

  • Size

    909KB

  • MD5

    9cd0140130128c33d25656c066220dfd

  • SHA1

    d4efc947c2b684c194d565926be9996a3428b095

  • SHA256

    160ad15742e34779c030c0736a6a61dc2b85ff7a2341b2c82cc8e144c9019384

  • SHA512

    66f73320cebfe8c7ae9e01d4bca5845ce7008e9cde0f3d56be6d25f5a815a17ca09c195681d21a3c4f12fdd84673f7ee506ce0cae89d7737924ee0e68d9aff8c

  • SSDEEP

    12288:wkyI1m4TaksDM2dAEAqyYCJ41oVls5pFR8SLaSNsTeM3KukimOvch:3So2dATqyYCJ4gC58SHel

  Score

  10^/10

  amadeygluptebaredlinesmokeloadergromekinzaup3backdoordropperevasioninfostealerloaderpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1