Extracted

Extracted

• • Target

    ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788

  • Size

    994KB

  • MD5

    e21b7afdeb96d1c7ab452794105ee343

  • SHA1

    03f0176dafd9f4abc84381b4bb4a721da5626f0f

  • SHA256

    ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788

  • SHA512

    b4e87b5c12de70f839f2d05f6b71289f5bde8ae709e016b95bce37d734bed35ea1cacde0a0a0e1391fc8a82b2f6c56e4292d76fe2e45240050bf8c75a92678e7

  • SSDEEP

    24576:QyRyqLjY0wDw8RzIZXPFgWuTvQ5VEq7WQ41/9A8Wi6UM:XlL80wDw8CZXPFbEvQ58Q4N9qU

  Score

  10^/10

  healermysticdropperevasionpersistencestealertrojanamadeyredlinegruhainfostealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2