Extracted

Extracted

Extracted

• • Target

    e2f2fcb441deac115648a4ee34559ff4bf80bec3a9498cf370559ae4ae691b82

  • Size

    1.5MB

  • MD5

    0b074ee193f89eca3f18d923d2ba9835

  • SHA1

    e2318b5a1d8d2d8a54d3da48a872aaf61c388fb6

  • SHA256

    e2f2fcb441deac115648a4ee34559ff4bf80bec3a9498cf370559ae4ae691b82

  • SHA512

    4c5ce19e07faf5004b28e8801f424a7e13573e67fd3e3101dfb57d36e4df901a775b8be8d8efab124f54ca1d1e9962e50dfdbff5094b264bc28b67483570d358

  • SSDEEP

    49152:rSd+NkqzxylU+CsYE3IUOxIqR0/ozpNere1WB:mnWQYE45SQpkre

  Score

  10^/10

  amadeydcratredlinesmokeloadergromebackdoorevasioninfostealerpersistencerattrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1