Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    0x0008000000022e42-67.dat

  • Size

    221KB

  • MD5

    5174bd57aa66a91fcdfb9d24edbf91b1

  • SHA1

    1be1d7363be0143e41f68c4aa9219ebd7283f92c

  • SHA256

    e78328913eb6e865be32e3377f5292f665c1a9af986cae800261449cec698121

  • SHA512

    70bdec84d292737f618b0f6c8c7fc98de5ab0be1483165c43465a015194b290719c8072692fd3bcebd3ef8f4f6154ca5d58e7cb6c3a45fb2562b30198759bc10

  • SSDEEP

    6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS

  Score

  10^/10

  amadeytrojanpovertystealerredlinesmokeloader@ytlogsbotgromekinzaup3backdoorgoogleinfostealerpersistencephishingstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Poverty Stealer Payload

  • Detected google phishing page

    phishinggoogle

  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

    stealerpovertystealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2