Extracted

Extracted

• • Target

    7ae1840912f459561c355eb378644eb572a804e9c3560d097ac4d2bd43dc4f26N

  • Size

    1.7MB

  • MD5

    e0232f9f78dff4a9d0848bf13333e480

  • SHA1

    cebc6cddc1d5973a11d834005ddcc844416ab907

  • SHA256

    7ae1840912f459561c355eb378644eb572a804e9c3560d097ac4d2bd43dc4f26

  • SHA512

    9b9856303d390b6af3a70852239bc31ff194a501e6398663d8161806c7362004bc04b1568f21f0be23eb276db52be7658e7773b6b848f4f54d70c9d8aef10bd4

  • SSDEEP

    24576:XysouA3jYma+wGBtIaKi6g7JoQi88HXhncx5UzA407Vm1Crl9Nn3PIxM5u:iqswOtRKYeQi88HXhnFG7V6Gn3ga

  Score

  10^/10

  amadeyhealerredline9c0adbmostdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1