Extracted

• • Target

    28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e

  • Size

    1.1MB

  • MD5

    7df4b8ce7b5ac615eab5d1cacd154392

  • SHA1

    0dadda3cfdb252fac95f1930e3188f9f04dc2a34

  • SHA256

    28363fce920b0dfd603ac499ee2e5404a26a754a382703442ec2131ab5050c8e

  • SHA512

    925fa6e8209baf662e04160184fb7357e0b6500e78fe1472dafbb1139256f17fac4d8d882f07365d846df3794b0ae9dba4b1cce3528714310ff0158b9bd442d2

  • SSDEEP

    24576:tyrOqE7qJFAqzvXq4XQvZH9HbTU+PtN4YtnDy:Iaa8C/ZXsdHbQ+PT4gD

  Score

  10^/10

  amadeyhealerredline9c0adbdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1