Extracted

Extracted

Extracted

• • Target

    15a51c6be5bf6923610a2c6d5287a57916e3674cd5996ccc54a29b857a6017bc

  • Size

    1.3MB

  • MD5

    133e056074a6f5b7bddb78acfc918b3e

  • SHA1

    51b19fe344b7ddba77d28a4eb88d9be8ecdb9643

  • SHA256

    15a51c6be5bf6923610a2c6d5287a57916e3674cd5996ccc54a29b857a6017bc

  • SHA512

    fd534a911af47f347c2ac62c70a0b829f3ecadac66026c711f2f97bf93d7b2a38b3f444c4a267804e9cdf6442a632d3df96620e7096eaaaf1aa7da3e6c9f3dc1

  • SSDEEP

    24576:IyhtUH0y/7QMsgCl36kTX7LGf22id+2VQAdbedAyXbDdJbnje3iTQ:P/UH1zYlNTvGf3iA2VjedpdJvkiT

  Score

  10^/10

  amadeyhealerredlineb50502maxonormdiscoverydropperevasioninfostealerpersistencetrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Amadey family

    amadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Healer family

    healer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1