Overview

overview

10

Static

static

3

ea88c359fa...49.exe

windows7-x64

10

ea88c359fa...49.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea88c359faaa4fd8219c7bcaad838749.exe

  • Size

    992KB

  • Sample

    231010-1c85hacc61

  • MD5

    ea88c359faaa4fd8219c7bcaad838749

  • SHA1

    4ba3527b280719563bc7d61f49617a50d507b8f4

  • SHA256

    7e0814e74e3bb08c84e19168154add2f70fc2bc486b337fcb2b8fd9d19105ad7

  • SHA512

    901399ae2d5e359ab56f7a37884d783ada23ecda1097b5abf94dac1db54ec30150027b23b7e499c511ed5869539e2644e712176fc27b8dcc35154e5b4ee6a105

  • SSDEEP

    12288:vMr2y90QfLCxbfINNmuWlHih5mSLFl9GJe4ltbwSQHmiNST24zYUUz8QGkpWQVec:lyND6EQP8AimPCz8xkQke+RLtuUOs

Score
10/10
amadeyhealermysticredlinegruhadropperevasioninfostealerpersistencestealertrojan

Malware Config

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Extracted

Family

redline

Botnet

gruha

C2

77.91.124.55:19071

Attributes
  • auth_value

    2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

http://77.91.68.78/help/index.php
Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain
rc4.plain

Targets

    • Target

      ea88c359faaa4fd8219c7bcaad838749.exe

    • Size

      992KB

    • MD5

      ea88c359faaa4fd8219c7bcaad838749

    • SHA1

      4ba3527b280719563bc7d61f49617a50d507b8f4

    • SHA256

      7e0814e74e3bb08c84e19168154add2f70fc2bc486b337fcb2b8fd9d19105ad7

    • SHA512

      901399ae2d5e359ab56f7a37884d783ada23ecda1097b5abf94dac1db54ec30150027b23b7e499c511ed5869539e2644e712176fc27b8dcc35154e5b4ee6a105

    • SSDEEP

      12288:vMr2y90QfLCxbfINNmuWlHih5mSLFl9GJe4ltbwSQHmiNST24zYUUz8QGkpWQVec:lyND6EQP8AimPCz8xkQke+RLtuUOs

    Score
    10/10
    healermysticdropperevasionpersistencestealertrojanamadeyredlinegruhainfostealer

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Mystic stealer payload

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks