Extracted

Extracted

• • Target

    4db03b4535de7190ee2f7eb59d7d915da291867260ab36ea113dda6b533c1544

  • Size

    1.7MB

  • MD5

    f0cf96359e066cde3026d6d0c665bd42

  • SHA1

    2723c460cd3c96cbce513b7d5de0ae04285a32e5

  • SHA256

    4db03b4535de7190ee2f7eb59d7d915da291867260ab36ea113dda6b533c1544

  • SHA512

    3886cbbd4c3a77306795418562b2a899c35a77caa702ace21f98f3594c6c42ac1e733ed81ed42fd0228d7bcca60089c80991eb6ae055ec23434c0e2c7eca9221

  • SSDEEP

    24576:Wy4V8EgdAk7x3hMxRiAtm2Sv1OLv+KUH0gSCAunNaOblmB+lWFohP4QrQ:l4+EpTRPt3SoLv+1gyNJZmB+lWSR

  Score

  10^/10

  amadeyhealerredline9c0adbmostdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1