Extracted

Extracted

• • Target

    44b97541252adc5d379af7fcdca20fdeb60656906c454987769792c93a70b4d2

  • Size

    1.7MB

  • MD5

    bf11fe97ebffed3ef14a0c2cd06d6ddd

  • SHA1

    d9b3973571af0ef82dd6cbbfb6ac4d444ab42336

  • SHA256

    44b97541252adc5d379af7fcdca20fdeb60656906c454987769792c93a70b4d2

  • SHA512

    75f672efc202cf9bb70113eaa5082cc1656491e202895bbc383e2c64da8ddadc3fe43e21bd12239365960b285c4c98b368e816269b7203891c4c6f2ec9627805

  • SSDEEP

    24576:RyMZ30Jj3+0gPl5q8gES9AaZZ6DvnRCufS0014nzVYu39Rece4zDYtH:EMCj+7i8VS9nfavnRCJ4zJ9RCt

  Score

  10^/10

  amadeymysticredlinefrantevasioninfostealerpersistencestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1