Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    c5868c480376bfb62b2a4b23534756ff21fbcd5ddb44bca7400d42fe2e14a8fa

  • Size

    1.8MB

  • MD5

    c1490c65f2de99826b9b19290080971a

  • SHA1

    c1d65c785cbb2b3ea8013bb6e9dc0d81fa3785ed

  • SHA256

    c5868c480376bfb62b2a4b23534756ff21fbcd5ddb44bca7400d42fe2e14a8fa

  • SHA512

    bb2f10924723c7c530dd4c740ce39e3065e02732b00e81c9fa196f3d77cb50683a53b496c1141647d4cb5031b9acf94cef46c7b9b2aab44d3b0e9e52916864d9

  • SSDEEP

    24576:WyMJrMOc7XP5ql4bY/nVpEqw9OhE8SnkNsRqS72lujsxLc6Icvn220awuW6fdo:l2vcboimwEKJkKl2QjsJZD2v3uBd

  Score

  10^/10

  amadeydcrathealermysticpovertystealerredlinesmokeloader@ytlogsbotfrantgigantbackdoordropperevasioninfostealerpersistenceratspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat

  • Detect Mystic stealer payload

  • Detect Poverty Stealer Payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Poverty Stealer

    Poverty Stealer is a crypto and infostealer written in C++.

    stealerpovertystealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1