Extracted

Extracted

• • Target

    db2e2b95ac94d3666a086def2cd26f59409efc0789c695b1533bd28a476c4096.exe

  • Size

    1.3MB

  • MD5

    730932c158bd9645231dc12ab2b16b17

  • SHA1

    bd909e9b910a008027f7e5cdfe47907ffa319f84

  • SHA256

    db2e2b95ac94d3666a086def2cd26f59409efc0789c695b1533bd28a476c4096

  • SHA512

    64ff1165d156b5b6dbdb48a854d766d8b04bb41683877fabb6703a03f1836c31de092c9a8999ce29971f12fab0720e68a9f206c0ced92ede8574fbb0f54335c9

  • SSDEEP

    24576:vyHKm5LexJJtS6EHHFakg6utMr1405r/DI8aZc10j8Q9z9C:6qWUPtlEHlakgDq4SbUc1ZwzM

  Score

  10^/10

  amadeyhealerredline9c0adbgenadiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1