Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851

  • Size

    294KB

  • MD5

    19b2c4ee9781e95ecd5db74de6fef0a9

  • SHA1

    fd5f11a55b1d7be9afc06faa72b27d6d19706c17

  • SHA256

    1d90edda9fc0271748934c0813b8946478823a33b5892d1be2ddf3d383fbc851

  • SHA512

    ea137d3330c7fbdca25da29639447211fb36ca49f8e77f38b2b6428adae63ee097ce1564fd4edc0742b39c13854d868dc87f8f08bfa9b5698ad2149a7c1843ef

  • SSDEEP

    6144:hTwlNlUt5IpFvjcFRh2/GpOZMNG5L3cYp8eesbZ6O0:QlUt5IpJMLp8J3N8eesbIO0

  Score

  10^/10

  redline7001210066discoveryinfostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691

  • Size

    390KB

  • MD5

    1b39c696c7ebdec56e5bd5e819ff51c2

  • SHA1

    13499e2a975747bbc7dfa629b93c79143980cb5e

  • SHA256

    1e44c41d8d889c0d0e018128db620f95ba933996ae31dd11da4f5d407c764691

  • SHA512

    bd4e865d924da4f2cbbb97f96cc5b31c88f4698fb5d4bc109e191336171aa87f64458960279732395e1ec47c4a10683809435612d9bce181f440a653ff2e3f8c

  • SSDEEP

    6144:KKy+bnr+vp0yN90QEITqYImmruIrRHY6y0ZJJqB5bu9CVCyXyNRK2h7nSXO/:uMrry90mTImmiazSBJlwuXO/

  Score

  10^/10

  amadeyhealerredlinekrastdropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral3

• • Target

    1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e

  • Size

    514KB

  • MD5

    1942d1d3d93833f0a1d4f5381ce33a23

  • SHA1

    4056636db4625bb6b3fee03b4c1be992681affa9

  • SHA256

    1ed736973ca7eb70129cafb36c292298f34a8a710160e69aeec7ad93760ed83e

  • SHA512

    a9569c93345b4565b8e9bd30a1b09400eaba1ddeb3fbcf00d53563d1ba34d4d6f4f5bba9ffe6852ff699de66e8177eab35ffc771741fd9d528e6802726aa3a6c

  • SSDEEP

    12288:SMrqy908fsn+JqW9WsGJPMj1kn4tBA6jmcRyqBq08:4yIEqwWsKmy4YikWJ8

  Score

  10^/10

  amadeyhealerredlinesmokeloaderromabackdoordropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral4

• • Target

    40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14

  • Size

    390KB

  • MD5

    1c159711a0fa545221fe8691458a6937

  • SHA1

    43e192dbba8a69c2a991113cd76384ff226c1bec

  • SHA256

    40d54c2855f2d7fa637ffb916d28fb16513aa414f6fd1a641b34f92af0d12f14

  • SHA512

    f513099fff768e09c25e8c6ec98cc6e3bf3a80b79a23271168ccce522023ba3c1a07ae314d465989b796bc95d185470d3cb0a4f4a2198b08859d1bcfd99a3ceb

  • SSDEEP

    12288:7Mr2y90/IdHAL/TtEh1a6SESB/MMMTZKOCW:dyladEbaaPMMTAO5

  Score

  10^/10

  amadeyhealerredlinekrastdropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral5

• • Target

    41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404

  • Size

    921KB

  • MD5

    1beb0795600816557ce325b1c1b59324

  • SHA1

    acd5093044581410d96d772542ffdc6894a135d6

  • SHA256

    41c3e42a10f8af49168bee5f6dea01eec1d5e814739aca0229cec79aa4fb5404

  • SHA512

    0b3f9aa94ef91c59bf2247bddb2c481a4cf5bc5bc51a27c48d7ba016027f9b653ee92f77a3575e60061db0201b334e11cfef11e942ebf984dfc6cb7d68545958

  • SSDEEP

    24576:Jyp6CnbbnjhaWAaqWc5YbDUAmuHVunxx:8P8faql54Dl3V

  Score

  10^/10

  healerredlinelampdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral6

• • Target

    559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2

  • Size

    390KB

  • MD5

    1b4800daaaa7c169f68ec120ba2c3d92

  • SHA1

    a70c58e128758611b3a359e6620c3a3e81bcf767

  • SHA256

    559234fc528754d07d788aa5eff30aba166a9bab82e9eda45a9737647b0e9fe2

  • SHA512

    da8bee5a9df9b4263d8b2b3feae9131e06a3f3e1d9e502da1996fdc6eb2190eaccfd5b6f0b338b0ba2723c6432878f8b5a017ec78dd2c2a52d357ab654fa82f4

  • SSDEEP

    6144:K6y+bnr+np0yN90QEo05rDWFqSlrjVfhz4y7mqtimt3n5jkH3IQ:6Mrvy90m0kBBF4y7mqtpZUIQ

  Score

  10^/10

  amadeyhealerredlinelandedropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral7

• • Target

    55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648

  • Size

    862KB

  • MD5

    1c8fc14d422af937677324c6d9a163f3

  • SHA1

    7e8e44f96dd39e0bac0438b3b09222822f8d6f57

  • SHA256

    55c06ba8dc9fb792c52ed9ed716cf4f5500da9f73bb66c9ba720a9cb2b666648

  • SHA512

    29999966a3d445089aa46558e390fabcc6c870575d235e06bbbfa70393ce40d9c15683d83df105ce34b62cdfaeb72afc9d044aaa776513ea7dfb4bdd4540a68f

  • SSDEEP

    24576:byBt5t8kWf4AJRSH+aZsv/tClEZkijZ9KA+:OBPKkWf4kSH+aZsXtCGX

  Score

  10^/10

  redlinekirainfostealerpersistence

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral8

• • Target

    67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501

  • Size

    1.2MB

  • MD5

    178421ab07fbeb11767d3bda7c24a4d4

  • SHA1

    c2fda877254635b05fdda955b6a01651251ec00f

  • SHA256

    67045db9602c0bb02004555fcae5f1c816ba6ebea367c933be035b042c153501

  • SHA512

    0a48c98fe000cd134b9712e2c812bf92523500b99190b9fe82d4f9e02a05305cabf37daf24ef0feffc5a0bee08d8c7a766c87a29f724652e523c95ef22a58ba2

  • SSDEEP

    24576:dyvPA4Sk2aRNRajD7T6B/M2+cjk3w3nz9KXwsvJO6ejg/vi6a:4H3SpaMmk2zk3GzglvoDA

  Score

  10^/10

  healerredlinelampdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral9

• • Target

    6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c

  • Size

    359KB

  • MD5

    18eaeff3ae40e541cbd0cdfdc2298885

  • SHA1

    2fe4663c9d407d97bebcd035d901321dd1d9ef3e

  • SHA256

    6d684b37ca877d403cebced125fab4f36a37e290840da5678e0d43fd35796a5c

  • SHA512

    83c4ef016804df631b4169aac8ff88210d74017b8b19afa7e791bbf9e6c852de2ce64482ce6c29530b4557e75c40f84a827993b3d0f414a0d3306890652bfd16

  • SSDEEP

    6144:Kmy+bnr+Lp0yN90QEjHCyMnb6yUchr1x18mlQVMhyoVAWgWMvmy:aMrzy905Ob79hdEmJYvmy

  Score

  10^/10

  amadeyhealersmokeloaderbackdoordropperevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral10

• • Target

    755b6a534ecd54fe181f1ec9de55ba3fba4d9177430ed1586a6ecc6183812e41

  • Size

    1.5MB

  • MD5

    1bb75354d6a880535e819b8fdf2c8d44

  • SHA1

    94e0291d9d7edf7ccd5f353aa0ada8e05e6c8dd4

  • SHA256

    755b6a534ecd54fe181f1ec9de55ba3fba4d9177430ed1586a6ecc6183812e41

  • SHA512

    006930c07e78a96131c1a339f014a82ce92ca1ecdacb6a23415316fb89a3f0394cd8379958278e8482483730d5435bea8f6bd81411ca84ac4a69ed31952aef21

  • SSDEEP

    24576:iyVX5loIiP1DgjsZYPlJ4HIpTuWNMrNMbKXtmwHHRe6YYZDQQDljvq8Ek:JVXAvPKIELmUTXNMrnRReFY5QQJjvq8

  Score

  10^/10

  healerredlinemashadropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral11

• • Target

    77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf

  • Size

    1.2MB

  • MD5

    185f86ba2e9a422cdbc2d5084d00f57f

  • SHA1

    68d18b2eb55b0e52f3b60c8a29e297b4e2593418

  • SHA256

    77cbabe9fe3b8b9ac3422f2b29fbcb0cdb9ee85c7b64b2bde48da25f6ef608cf

  • SHA512

    ab31a0d8ca9d6258f0ac08e0e2fe036bcae54115eddc129760bcf8b43ea51e6f284d6fd533850233c753cfdb864826ea9758866e4b4c5dfdcef7df0137f49d73

  • SSDEEP

    24576:2l1TeljsInpBxcyc40xvOGe2ELrnqDgZBJM:2nlInpBxcyc40UBfqDi/M

  Score

  10^/10

  lummastealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Suspicious use of SetThreadContext

  behavioral12behavioral13

• • Target

    b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032

  • Size

    641KB

  • MD5

    1d0fbd5c41a0aef56f28e1c20d10e394

  • SHA1

    aabbe503a0cd0511597bcfdd4df77993b1af0f76

  • SHA256

    b0f8fc992132e7592e37766b35451eaa7dfdbfd3d15abe0b8c692f700870b032

  • SHA512

    fed895eb492ae6994d0dcaa145e779bf46bd7cd92b98fa1f14e35f7fc3ed63a070877d2b56893393425576853510600fe99b4a7b2f13f2bab56396d4b7dd1c7c

  • SSDEEP

    12288:QMrey90Wa5yBOAdL1yBrSFbUhlBXxs8SHlaCYYMrk6SpoBeaKVl:eyFaEgAEhvJSHECYApIWl

  Score

  10^/10

  amadeyhealerredlinesmokeloaderpapikbackdoordropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral14

• • Target

    b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf

  • Size

    514KB

  • MD5

    1a923777979bd128a48a6763dc11d9e9

  • SHA1

    49fedd0810c09f8ba69ec86fd6640b15d51b5e85

  • SHA256

    b72cfb25178ac78d0dfae350873df231a1f4266a913f47acc5018b87cae84bdf

  • SHA512

    590fdd6a3a9a3ca0acf772624b47eb40016390d484bf0a3e61eea2afb091b8387c29a24ec6e9113240281e4b4b380e060bec08a1d400ac7f92ad6c24f2927aa0

  • SSDEEP

    12288:pMrdy90UCukTJyxW8iKhhYuEzBuu2wgmF2bq:MyxFkTJy5zP9bbq

  Score

  10^/10

  amadeyhealerredlinesmokeloaderlandebackdoordropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral15

• • Target

    ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da

  • Size

    925KB

  • MD5

    182c7282a0ce3f4b3167518c8a2f9d66

  • SHA1

    7277f55f22c18008840d4aa0c65721df2129d761

  • SHA256

    ca6d56a637f121ee6406def5cf89663c3e54b2e175e98d4469fb3e3a46e190da

  • SHA512

    57895e1fe2d89271097e920e8eeaccbeafc861fde18aa85cdac7cf716cebb332fe201e2821512be04a92c965894526c3f7bcb8d3d7b010909cc8318f95ce79a0

  • SSDEEP

    24576:UylKFVXmbDRGB2xA30pIMporMtfc/FgIHs8:jEVGFGB2CkpIuPtfees

  Score

  10^/10

  healerredlinelampdropperevasioninfostealerpersistencetrojan

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral16

• • Target

    cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd

  • Size

    359KB

  • MD5

    1d35227dc69f9a1db2c7b1c8d8ba88ac

  • SHA1

    37c2e710401fae57eb2458ed512d1542e7bb829b

  • SHA256

    cd303f71adeaea183389fffb15fb03508d79b98f35d685735ce2273417b6d4fd

  • SHA512

    a520fdbe8d7a9c4177946d9059a2315303803c70c2879e1c9aab78f250f6081c5ede6f74a1136540d6b7615d6082be968d44ebca736e2070acb3d745bf678a3d

  • SSDEEP

    6144:KGy+bnr+qp0yN90QEIDI2LskW47xNhqRptDek7A5Wa2ttwLUWnqs:CMriy90uM2Loa68n/rz

  Score

  10^/10

  amadeyhealersmokeloaderbackdoordropperevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral17

• • Target

    d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578

  • Size

    359KB

  • MD5

    1c2abdcc881f4bff6162de485791a3fe

  • SHA1

    7cbe151af7d6a24026efee50a585397cb0d9c516

  • SHA256

    d7a90d17836776eedb35136022c7ba7fe79203cc0b8c97e790b459c0afd5e578

  • SHA512

    3e39497d21fddb205ae84be7a7e8265d6fda3070a885a19b1f45e996e04eb801ace5dfcedc04874325788ec3bf75f1f5ffe79297b34f82e0c7b98218c26b21a5

  • SSDEEP

    6144:K+y+bnr+qp0yN90QEAQegx/CUYC7Fhec0EfAAYXwwLo9/cItKNR/WU1Q90b6f:mMrCy90hljYWhEjA3/ztKNNxL6f

  Score

  10^/10

  amadeyhealersmokeloaderbackdoordropperevasionpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral18

• • Target

    db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb

  • Size

    274KB

  • MD5

    17c694e79f6d36c7ddf2d0826847af9c

  • SHA1

    4a9ede0f5efe78a4807230fa8dc0ae4d9e6fd9e8

  • SHA256

    db14966ca75480a4e8f9f3d18c7bada2f205a1ac7404dbeda068279afa55b1cb

  • SHA512

    bfe84a7d6a038df984e6d789c0169771a567488137d01b8df27b67706aca915fddb14d510dc9c654281b25a2e65cf5c57d009b16cd78a0170ee13dd70e12b363

  • SSDEEP

    6144:SJhy0g57Kx1lgD0568wQ7tuMp2tHnAm9CMtM:SJhcx0568wbt

  Score

  10^/10

  redlinelux3infostealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  behavioral19behavioral20

• • Target

    e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd

  • Size

    983KB

  • MD5

    195bac3e181550a1749e52bd3abfa2e1

  • SHA1

    4c44adf44e16bdb2d5891d0ca5534e25d8cd8811

  • SHA256

    e800205bb9a5d3866d735915080e828250891d7d9c930245afd8def35dd08dfd

  • SHA512

    7ac7714a302ee5d0a2592b1273fa20f3162a4c8e46519274b97bfed634a28fa461d19d212eb648b6c540bac10dc7d94b9651548d9d2bb3f58e39de1c4456a41b

  • SSDEEP

    12288:xNJJwXdk+4w8ea9YVhYu48bk0/jLvzVbJmeMIulognDsexGeMcQh:xNJodk+4wv+YVhYu4r6LvJFsngve6

  Score

  10^/10

  redline5195552529discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral21behavioral22

• • Target

    f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41

  • Size

    515KB

  • MD5

    1b6ca4b3887874447697d2dac0664cf5

  • SHA1

    0b2ef46a6bd9883b04ecaf8ae6fc47df13e2f8f2

  • SHA256

    f8a2da44f9c18482323d9e1ed99567d3a35b95656bc1b023d86e12f305565c41

  • SHA512

    4435a0bfc90dd2574a28ce91d519a4566ff85413fb13b5c6690d2e868410abda41ebd05e4129f20fdfafb989d5f2bf424ef84234925ebb33123e0a434a4d6a5d

  • SSDEEP

    12288:XMrfy90fa+YaQ3g3aNwmYu4neyzKmErzq93TU1cFdsJ:4y0a+YahqJYuGey2HAEJ

  Score

  10^/10

  amadeyhealerredlinesmokeloaderlandebackdoordropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral23

• • Target

    fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3

  • Size

    1.2MB

  • MD5

    1a16ee68f1207233e67c2c808805a723

  • SHA1

    e2867e17c5b2cf680cf121ecfd388dc4f9380035

  • SHA256

    fc8b501a1823496ec4685f1c935710517b2ee5331f98bf10c5eb7b69350e59d3

  • SHA512

    7330de14cde4232c5020944b2a21f11bb9a238762b71e0947315bbb749a749c9d1b0500a03bd8722edc3f748fbf03d3045eb6e41e101e4340c207af9c24d40b0

  • SSDEEP

    24576:7OG/5S/uUaFhBylaHU3TMzhIhH4aZGjpUwMHqsOL+QX:7OGfFhBylaHy8DsON

  Score

  10^/10

  lummastealer

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Suspicious use of SetThreadContext

  behavioral24behavioral25