Extracted

• • Target

    b6f6d8448e34fe5883c51d0ca04fb25bdf12cd60597a17ba8f7b8437459429fa

  • Size

    1.1MB

  • MD5

    4d8664f1d96b4e274b9b66e7e47f90d6

  • SHA1

    f6a310423357f2d12ab592267007a0661d18495a

  • SHA256

    b6f6d8448e34fe5883c51d0ca04fb25bdf12cd60597a17ba8f7b8437459429fa

  • SHA512

    2c95d19ff4cd3cc20f0016130924083185f70a68339fa56f8db8f1d06d382e633a8c4cb2c73119607a75e7a44b87aa8f4c14669945b7bbf3c2424bb6de04e455

  • SSDEEP

    24576:9ycwg1kBZtFG5+8RMwjTu5p6SJey/VljY:YW1k5Fd8Rrja5Awew

  Score

  10^/10

  amadeyhealerredline9c0adbdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1