Extracted

Extracted

• • Target

    c75b5d7b1f972346a64adde2b85a45b0896dd0f9a78bf2a38ebc8d1f712743dfN.exe

  • Size

    1.3MB

  • MD5

    87dc9f618586a6abebdc3bd8bc1e25a0

  • SHA1

    f49b364852aa23476aeaa23297187e4230d3e779

  • SHA256

    c75b5d7b1f972346a64adde2b85a45b0896dd0f9a78bf2a38ebc8d1f712743df

  • SHA512

    1312823e4b691b6ab1f88f25dc56d051de75f9f9df4abaa80c3ba11fdbd89c2934e51d166f334aaf8b4c26ed24417826a5b3419466400082c1426cd41b8ca902

  • SSDEEP

    24576:7yKTEdFjl928ktLhUYsS79oVwZa/tbWa/leLkC8ywjqZh:uKQd52ptF59paZ98p8y/

  Score

  10^/10

  amadeyhealerredline9c0adbgenadiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1