Extracted

Extracted

• • Target

    b07b690640e1bb4da52f4ed8c1e75586c0d663c5b096a4be08c3e4984d55be99.exe

  • Size

    1.5MB

  • MD5

    74846dfb6daecc88d2917b6e30aa16e6

  • SHA1

    e5228c444616ac77e024da5a6533dc1df8f39869

  • SHA256

    b07b690640e1bb4da52f4ed8c1e75586c0d663c5b096a4be08c3e4984d55be99

  • SHA512

    d833542d74901dd0b84fc1d3375044f379491cf6f6e10c22edbcfe53fa9c8b8c44ad6dc53d4648c3f516d28f57a9018f94d03c4b7b01857112579d00c5a15831

  • SSDEEP

    24576:YympPPAzb/rapJD5tkMO3DGIMaMCMdsdalfKylRMdw5NKeZsxGUqs3kH6E9gqq:fiPWHWJFtDUnMLCMdsdalfKylIkNKeZY

  Score

  10^/10

  amadeyhealerredline9c0adbmostdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1