Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1

  • Size

    1.2MB

  • MD5

    861cdcff71d268dee3580d2ce333ac09

  • SHA1

    94be6d1757a7ab5c0d5ebd464cafb71bc1c5d33d

  • SHA256

    27efa43e160a77456643b18b13206f1f8a13410ef51729dbe8fa2997f36694c1

  • SHA512

    b2e905338edbaaf101bd94b91c801972ff30f49a8f0f4740c67faa7e8d3c2be243d0883cec424f9db46bbf7b403ae72b5a6e3201d0861093e9084e920a9f1581

  • SSDEEP

    24576:ayE5p8ogugja8IT5+YVQ0SVU97kNQ7hDtYT:hwZgja8G5+k79ANQlDtY

  Score

  10^/10

  healerredlinelampdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1

• • Target

    2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783

  • Size

    390KB

  • MD5

    88cd3287b5c63e0998547f5d6f44ee26

  • SHA1

    34ee86ef1950746fb4c38d73de30714f35a49dc9

  • SHA256

    2fd7c050fbac5e1af2ffeb7fa80c3d86adca912aa0593a6fcf0ada9f513ba783

  • SHA512

    66881b34422644be2eb840992e90f73429d30018aec01c75c349a6041bce6aa279afe71adb404391371a55caad733a907b6cc6f4a9af86b2201bfed9523bd32b

  • SSDEEP

    6144:Kuy+bnr+Sp0yN90QEnqLaM6P8is7lQuxVkkm2ptpk9h28:GMray90GJtKuikmAq9k8

  Score

  10^/10

  amadeyhealerredlinenasadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral2

• • Target

    31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459

  • Size

    390KB

  • MD5

    8965f85cd8ceaac637f7ce969b31e87f

  • SHA1

    e83a34bca6d34e37cc4652d12d30e994aa9856c7

  • SHA256

    31714e287ace88f54febd6e8f4714a27d61ad35bc95ab8b019334acebd9cd459

  • SHA512

    795ca8c878ea4eb32e2cba9e01bb1d0d8f31563b910504f1687034c134a4e48e2196b06b5b139ea9408fdf7817377841c6544fdb26bef0a0089340d66c25be5b

  • SSDEEP

    12288:vMr5y90TOiPLI6kQHj0rPxqcHnl9va4w5N:iyYrLVDuPx5HTa4wf

  Score

  10^/10

  amadeyhealerredlinenasadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral3

• • Target

    4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5

  • Size

    514KB

  • MD5

    83901ef0a5b975b100a0dabfb11c7cea

  • SHA1

    34a15996b4f2d4bcbdd398658f85eb07e1c90345

  • SHA256

    4663b4277cecac818e54c11c72e9cf1ad537fe10a266e09ebb9f0026ab9a96a5

  • SHA512

    8bfdc76b1f5abeee4a9043b60adc7992262f980ede10a4ab3c4202f088c4f906aafa70a6da1ec7e729018276d84b8cfe8fff70880bf09488baec63619284893e

  • SSDEEP

    12288:rMrXy90YS+RDQE4GGAqO6wSgaqsoCpAPiFT1lg:Ey5SjvGEOJu5g

  Score

  10^/10

  amadeyhealerredlinesmokeloadernewsbackdoordropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral4

• • Target

    4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77

  • Size

    390KB

  • MD5

    859f7291df89d775b2c13b9eba46f15e

  • SHA1

    cd432f7142d19ca13261a674f4456669fff79c8d

  • SHA256

    4ef1a0149daef80693bc6f0b8f8337399c8687c08ca4792d24e3bdaab9bf6f77

  • SHA512

    6ffb75ac3d4d5a3cfed9131d46abd4dc0305df6125c5c4e6e926541ee360dfb2e0ed497655873f483089a4154ef5563a691aecb0a5bde83e456e983976411729

  • SSDEEP

    6144:KOy+bnr+op0yN90QEJVyucfzJ8b9U+BuekimU0dYTCcHnlRHBd11szcoN:6Mrsy90RcF8b20qUscHnl9T11snN

  Score

  10^/10

  amadeyhealerredlinenasadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral5

• • Target

    55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf

  • Size

    390KB

  • MD5

    886cbfdd99e1429ee45e56555632595a

  • SHA1

    4e6bf126ffdff44ff512d4dd7a60a410fd53a6c3

  • SHA256

    55de348478f00c0877bff6a44118e1b412443ef85c1e45f12245fb8483acb6bf

  • SHA512

    3775eee232fb7bd63faf5c10e123652be95db7e66e595114239606ffe91a6be3314d521315035bc5b05a3c5345eb791520409967e9345395221d549c4dd1067d

  • SSDEEP

    12288:YMrYy901cQx64cJM44GRgBYCoqZlqW3jN:gymbx2S4j6z5W8N

  Score

  10^/10

  amadeyhealerredlinenewsdropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral6

• • Target

    62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571

  • Size

    390KB

  • MD5

    89cdfc1ba20fd0bc35bb56ce6c94527f

  • SHA1

    8ade187af24b731e949253707b8663fe499b9947

  • SHA256

    62e08aa2909617f096cde8be4d834830bdad6f0907e76c051970413bb9a81571

  • SHA512

    74dd96290db3afc27d81db8149cfcd28206cb4faf40ff07d49dc9e71c462b2df4e014db345d5a8e954bdbd5c3d40ddcd3676639ac2033563ac02617409ddd4d6

  • SSDEEP

    12288:mMrJy90uJ//GRw6QQHnNYZiHW8cHnl9brxi:DyrJWHNHHWjH3w

  Score

  10^/10

  amadeyhealerredlinenasadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral7

• • Target

    7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386

  • Size

    390KB

  • MD5

    89c17915df9ce682ef8e12bbde7e8fbb

  • SHA1

    2405ab9354eb3a8806d44f481802b56b45e7aaf9

  • SHA256

    7c2b1a4696daa48a0b33a675af61f83d79ca86e3128c3e721bb51e375d18c386

  • SHA512

    f1caadcd67c105a15c34c795a8b4779c2ac22584e1827a36d41fb7118afd9223dc118f9a44f399936a75c0ef5fef0f0c67467d91b76e65bc77c91bfca5cac896

  • SSDEEP

    12288:vMrpy90k2MM9xEhIWgBYCi0xcKxdApCs:myd29Eu1zaKxdAp1

  Score

  10^/10

  amadeyhealerredlinelandedropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral8

• • Target

    9712f3ca55a69dc82a720b41eeb39aa2d2482719c764715d774a1d1d1d11ea1a

  • Size

    389KB

  • MD5

    8db815190d477d5ff3320f63ee0322af

  • SHA1

    f20c18ef6555549e9d467d3e63258dd51d561b7c

  • SHA256

    9712f3ca55a69dc82a720b41eeb39aa2d2482719c764715d774a1d1d1d11ea1a

  • SHA512

    69b513a14c430ab26e06de529b07ab58624fb813c25e2b26db3e62db5255f537765c61c9fb0fcc8413ba3b0bc41d0ec3a593656012f8b4eeb63e398fee3057d8

  • SSDEEP

    6144:Kuy+bnr+Hp0yN90QEXnPQvYkWsjZNoBnY6y8byR+cuVsv33+RRSlwlBEfXSm:SMrry90VnPiyY0yR+5Kvn+R8JCm

  Score

  10^/10

  healerredlinenasadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral9

• • Target

    a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119

  • Size

    922KB

  • MD5

    891f1dc06713b9c0c010f03349cc76bb

  • SHA1

    b9898973e542acf5172b5fcb94f52111036cfc52

  • SHA256

    a2578cb8fe72f0748c7fe615457b7d6aaf54e7985f27f459156f659d0937f119

  • SHA512

    bb1495af08880fb6f402d0bc13582ff0d7cda5010127db0c01ad01ef4e018deb273924acc319e917f41666853233e456a2243db6c9ebb3041fb8c4d052b7c234

  • SSDEEP

    12288:6Mr7y90xRF1KUynJmZMQ/uYVj62Y75r7qtDA75J6aBOoJe0vPd0NOs2g:pyYXaJmZMQGY62YiuJBBOoJe0vPkug

  Score

  10^/10

  healerredlinelampdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral10

• • Target

    a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e

  • Size

    390KB

  • MD5

    8dd39449e98f9ea4edf4c974c3e2872f

  • SHA1

    63c02fe8b295561277d33792a921ae770ba34afe

  • SHA256

    a2e15ecbc2385dacd7bc1a3a58a295213fdccc9cc1f85d38c2a7ab13a599f33e

  • SHA512

    86a2995cabfd1d1c202c1663ab2f478eb6716bb10ce728cd65251dc9ad937434754ac42db4f5f0e162e3b51a50499d188029025f03f0e7fc0e29ca9993d332bb

  • SSDEEP

    12288:CMray90Yj7GRDUyI9Iztzkdv0u44ENz0Nl:gyv+tU79ACdTP

  Score

  10^/10

  amadeyhealerredlinelandedropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral11

• • Target

    bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2

  • Size

    389KB

  • MD5

    8a93f2fead052a76fbae72166ac8fb12

  • SHA1

    d3717ab4c59cc8ede584e2ce79bc768d62a03dc3

  • SHA256

    bc1039ea1a02cf1e898c7cea2600cac8f44dbf43b2b49c31da3024ffd998a7c2

  • SHA512

    cade714bb097b4e24cf985f5156bf55ac4e3390c812055e4e5f10c118e4b2e40d9b449e8b2f236ca9b3095382f884e7f49ce17779362f1cb7a44255c7839711a

  • SSDEEP

    6144:KZy+bnr+wp0yN90QE/Yd+B4GwMEbYWOYNdGGxPYuQX/ceXe:fMrIy90TFIYPixAuocj

  Score

  10^/10

  healerredlinenasadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral12

• • Target

    c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae

  • Size

    390KB

  • MD5

    86270699bad2681bb3f5f57f44a7094e

  • SHA1

    cac5e4b620f438ece23b6e9df463b99d2667a95f

  • SHA256

    c7a4524e38a070acf6ba7d4865de5125063cd4a021a47872adb720277271f3ae

  • SHA512

    92ed35d0f3a0c22d5be759b2cf71064194e440601cba0b848d6a4440467820273b446a38069794da757c2d1c8ae760792a5156e69e4cf5aeaeb003f8ee740443

  • SSDEEP

    12288:sMrYy90slB8Ldj5DBLjkSaHAcHnl9kkN6Kw:MyJ8D1lO/Hc

  Score

  10^/10

  amadeyhealerredlineromadropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral13

• • Target

    f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865

  • Size

    1.5MB

  • MD5

    85e57bbbfa4b4a93b3389c480fac7189

  • SHA1

    bd185ed9b704ae08c0fd652ca05ee3f3cbfccef5

  • SHA256

    f47fb04ed8077b20b9ca93eddc8ce4a4f05ca4367177fba67c1d87d2831d1865

  • SHA512

    10b7313ed100b1539cf8e4d6caaa996ee8185010d3d475c416b7be8e8f032514605bff766f5210d0921a96a9ad84730bf7583970949c9b62557b42db3d384238

  • SSDEEP

    49152:pvUrKe4i6MP4mUJJq5ZuIISIxVa46ecL:W34rMP4fTq5ZuxxVJa

  Score

  10^/10

  healerredlinemashadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral14