Extracted

• • Target

    5bdd23f6f6f8812457afbb7072babcc3217a3715aa7a37f805af3a5b446eed91.exe

  • Size

    929KB

  • MD5

    0d4c9f77e4abf6b2e8966d0c49b9315f

  • SHA1

    6942deb4f01b3abc65cb5e3a3b83919f3f64e146

  • SHA256

    5bdd23f6f6f8812457afbb7072babcc3217a3715aa7a37f805af3a5b446eed91

  • SHA512

    b25d88486abf1d18d189f20cb50b26e39d6513fa45520e472e037726771323c5324856a4560a0d225201f749d94fbc00e9536545ad545193e6efd8bd21cbdf91

  • SSDEEP

    24576:JygXDtaYpKr6Jc25BYfYaGRO6Fp18biyPJdp:8BHIQY7pKGyT

  Score

  10^/10

  amadeyhealerredline9c0adbdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1