Extracted

• • Target

    4042bc1e3de52c1fa2ec03d39b0a8632b8ca97f1beea1764eb78104cf6a3b716

  • Size

    1000KB

  • MD5

    83c7db7744bda3fd3718bd999aba6a4d

  • SHA1

    441c6790f06dbd0b9a356cbbd0927eb0ade70f90

  • SHA256

    4042bc1e3de52c1fa2ec03d39b0a8632b8ca97f1beea1764eb78104cf6a3b716

  • SHA512

    1f651e8bfe601f8d0ec94c11c7d8e98e9f470e16b567245561a36d8c52cba92ba1337bc432d41e50adf2e2b8f14b0a409e31938b8b68183c9103f93c2fc04910

  • SSDEEP

    24576:myCHrwx1MIbpzY25kO3LDCVuoRbKmnx9b:1CUnrWjO7uVbdn

  Score

  10^/10

  healermysticdropperevasionpersistencestealertrojanamadey

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2