Extracted

• • Target

    b5984f3db63a02963c0fd77711d8d07f8f5d35069d366f3b26c6272162ead140

  • Size

    1.2MB

  • MD5

    6474c52e215a55cceb1c0ac4b7170a33

  • SHA1

    700caec32a9f6f6530af579b52993b4a7b0f5adb

  • SHA256

    b5984f3db63a02963c0fd77711d8d07f8f5d35069d366f3b26c6272162ead140

  • SHA512

    13f478845baefff04e3b0085f7f212043f054d576394d480180b45aee331d50f6dab0ef8920cba75c8b491d07e01ec3ab40c68e64833e1e5b05df226dd153b7c

  • SSDEEP

    24576:cO72Bb3C+EnMAVTWzFIjU7hYCg7CMv8Z3wU0dU8+Oia4DY1j5:UBbBEMA+w0zKv8gzU44k

  Score

  10^/10

  amadeyhealerredline9c0adbdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2