Extracted

Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    8e05c72da260ffa2255ca5b309377959

  • SHA1

    14031a40973ef9851a9e6dd2d1843b00247c32f0

  • SHA256

    229e859dda6cc0bc99a395824f4524693bdd0292b4b9c55d06b4fa38279b3ea2

  • SHA512

    7d892604849fc3813913789659d101ac7533dd78bd06a5bb5a6f9bc4bab04a6b5775c55dcd3c76226324351df8e540d512da6c267d2dcd00b440e330f85ab703

  • SSDEEP

    24576:dyHo8DR+yHRO8U4EkyicLd4nkszZZz169AHg4XHXQn9rpWwRGNRXhSYOID:4X4yxO8U4UicLC1ZZy4XgnlpxYN

  Score

  10^/10

  amadeymysticredlinesmokeloader04d170plostbackdoordiscoveryevasioninfostealerpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detect Mystic stealer payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Mystic family

    mystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1