Extracted

Extracted

• • Target

    7b381d4013582e40428a1ca41678b385b702ccc1e5977b5caa240576c9e8d2a6

  • Size

    1.5MB

  • MD5

    00190145b871987154f7c9a9dbf93ec3

  • SHA1

    87c390c7f52a8f3d1205d4b7973d05da645e838c

  • SHA256

    7b381d4013582e40428a1ca41678b385b702ccc1e5977b5caa240576c9e8d2a6

  • SHA512

    3aa34a48fdaa9053565a224ea15cf85810323a24c18e6dc4675087716f638389acf2d776694b206991de05f20e00860f18345986b0ad1aff262cf0a3eb291654

  • SSDEEP

    24576:Hy7bybLDZIBvxvDltcptuknH+02bxk66c40JJm1ob12GNk7LqD1892QVLkQ4pJ+o:SfyHDaZvT0tdnHGNk6WQdNk7uD1nOYl

  Score

  10^/10

  amadeyhealerredline9c0adbmostdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1