Extracted

Extracted

• • Target

    NEAS.410d001b47c25bd88fe87e5c7d0e8015b34f86197def56fec81235c709e26afd_JC.exe

  • Size

    1.7MB

  • MD5

    f69074b98150ab50a55d6a85e41ae963

  • SHA1

    0baf230d669bf5bc487c0ebfd33a84c97f5808a9

  • SHA256

    410d001b47c25bd88fe87e5c7d0e8015b34f86197def56fec81235c709e26afd

  • SHA512

    fdc00c00db26b868bf033399e36403a077507fb9f82dc407d7902c38f685f38cfbc01637d8c948cc1d8a52dc1cbf4f2cf28e4be0ce12435c08a38a3036147109

  • SSDEEP

    24576:DyuC+DgppyZW6f7ukKEDThpdLmwUpgLbUEKYrK06Li2qDpFbeq2dch/Kkcqo5xmi:WUDC5i7HKEDTL9mBMzmabbT9KkcqoDo

  Score

  10^/10

  evasionpersistencetrojanamadeymysticredlinefrantinfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2