Extracted

Extracted

• • Target

    25fc4d5f40ae2e2be38fbdec5403840468d77c43fd91e75dd3d8bf23b1ee9f5e

  • Size

    1.5MB

  • MD5

    a72e3c9c7765a8e739b06bd9ba124af4

  • SHA1

    beb0d6e943c3efa39bbe9ba9664efab00fc4a964

  • SHA256

    25fc4d5f40ae2e2be38fbdec5403840468d77c43fd91e75dd3d8bf23b1ee9f5e

  • SHA512

    06b2af7db6ba44e218a943820ef25efe5b8d2de3c01f55063aef7ec830ef7f9284b6b56e1241600df92c5721f68d6a597ca4135300bad73110a3504c6e15605a

  • SSDEEP

    24576:MyNT6xUVc4/bflTcoYTTjpGv93RqZRYEpICPY01XOaY+vzbKsFWNP42KZIe:7tNKA2493uRYEC9i+f+hFWN3Km

  Score

  10^/10

  mysticevasionpersistencestealertrojanamadeyredlinefrantinfostealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2