Extracted

Extracted

Extracted

• • Target

    NEAS.cbef3cc73a8de12023058afc339c27a0_JC.exe

  • Size

    1.2MB

  • MD5

    cbef3cc73a8de12023058afc339c27a0

  • SHA1

    d852dad521684bd59dc4882d1a41768b99c464b3

  • SHA256

    9ec5d0e09febfa8b01bdc3537e7db491b4d99e977d3e19b7cfda27fa0a3d6624

  • SHA512

    6cb3a7cf1f1cfecd01650b47fc8efd725b8df0ce7ff52e079dc8c4d20eb2b54478b25f29e51433fd559d02aadff80e540562e8c52b736e3cc605598a269f69cc

  • SSDEEP

    24576:tySMI4KG1PBLn8RvvSwimYs8ZwFhMLhSDBFwgboHHomcfjUb3wwelWqWt/y6wkO:ISb4KG1PBLnY6BmYs8H1Mw4EomCj0zRk

  Score

  10^/10

  amadeyredlinesmokeloadergromebackdoorevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1