Extracted

• • Target

    e70d276e9b0ae7f2d5bf3ed0907bd9f9ce39dab5915241e5fd474fed254d5fa6N

  • Size

    1.1MB

  • MD5

    04c12432c642ec883b659740a59845d0

  • SHA1

    b01cd3f03beb02d5c29cf57d759d2b8e8a94dac0

  • SHA256

    e70d276e9b0ae7f2d5bf3ed0907bd9f9ce39dab5915241e5fd474fed254d5fa6

  • SHA512

    b589cc0bdda7c17701b7184f639308606643e1788053209b748dbec1a1f7db2e07b336c6738470749ebea48fb1c1449837ea21ec2998ddc56f489327264d0057

  • SSDEEP

    24576:8yFu+zCQFJNXfaRV8wS9JuaMbQuk2vbytNMEN:rFu+Z7favEuaMMuzvuP

  Score

  10^/10

  amadeyhealerredline9c0adbdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1