Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    59e022942e60a88871b00e0b3b2d5dcd7742e0104d5a6ff541cc6a8238baf512

  • Size

    1.5MB

  • MD5

    7e1b3be8dd66e23f64f16e7407e751cf

  • SHA1

    a0c78027ffb693149982b65e97a62c7ad19852fe

  • SHA256

    59e022942e60a88871b00e0b3b2d5dcd7742e0104d5a6ff541cc6a8238baf512

  • SHA512

    4ee4129af52c7ef8334bc61ee5e2a2765068f80f11388a68bd5c67473d145e8906b540b7ed3d5dd97f456344308bb5c14f2e0a6b945fa1105a7c3f69fa51c809

  • SSDEEP

    49152:n+PgvVUVO4mhX50U572vLIGlrJB9gnsmR0G+M+3:DV5Tv5SB9gn30z

  Score

  10^/10

  amadeypovertystealerredlinesmokeloader@ytlogsbotgromekinzaup3backdoorevasioninfostealerpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Poverty Stealer Payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

    stealerpovertystealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1