Extracted

Extracted

• • Target
    ae76f10ac2934f7fe175d79540fa20b19366a765ce137b72ddb24a85b33b19e7
  • Size 389KB
  • SHA256 ae76f10ac2934f7fe175d79540fa20b19366a765ce137b72ddb24a85b33b19e7
  • MD5 941f5827b877fececa48f58e3fdc1f0e
  • SHA1 35da0528cb0e22471cca109789591d603f550337
  • SHA512 b55ea6b9bc42781c207af1935bfa9e7e60ac4dfb6fe3746fba4e8af3db28bd981237760ca8bc726c9d2bcd570f466156248d394baca34e59c0092a7bba94ea6a
  • SSDEEP 6144:Kcy+bnr+Ep0yN90QElU8vFITr28UVeWx9wKRSzrXTqQkJzBVhXEfieumZRNU/cq:AMrYy901Je4EXRkJmieumZ0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  amadeyhealerredlinede7e5aromadiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1