Extracted

• • Target

    cae685c30fbe54a7617f9812d36ceaaa9e157c198098ef126645b0ec306510f0

  • Size

    1.1MB

  • MD5

    8ae4404b2f33e9b4789a873b4c679f06

  • SHA1

    50c18c49f8dcd5a64fb9653ea076df74e96da4b4

  • SHA256

    cae685c30fbe54a7617f9812d36ceaaa9e157c198098ef126645b0ec306510f0

  • SHA512

    fb0a6b6d3c2a8fa95c36ce6761edd4bd0359dcd4cdbb7e767947f64304f1ff537f2bcff7ae06b48995b0e0ff9836488beb72b6b2c132f294fff1df7dd033d51d

  • SSDEEP

    24576:yyu7BKo1pV02KYagjbBCcEEi9VpY2TRNSkfql2:ZKAoHdx9Njbir60Pdg

  Score

  10^/10

  amadeyhealerredline9c0adbdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1