Extracted

Extracted

Extracted

• • Target

    f85f279eb9593be0d62a7adf93606a89d76993942cfc9127586db0ae218cad9b

  • Size

    1.2MB

  • MD5

    9871fa3afbc32412b38fe669a9750d41

  • SHA1

    33cdc5e27324db9aa5adc8c5f7ec12da9e9714fe

  • SHA256

    f85f279eb9593be0d62a7adf93606a89d76993942cfc9127586db0ae218cad9b

  • SHA512

    a91dd29cbf67b71efad85c12a3e6d947e28d6700a0f6fca90287cda9ac9947a615941ddf6b47bdbcb77e36afafb7195acaac8b477842ff03e21c35853cdfbbf4

  • SSDEEP

    24576:myz8UisYqM/7a+MVS/36YoO5zH5DVmeJI6Xh2EIcoJdEM+:1I2TM/7dMSSz4zNNIe0EIPJdEM

  Score

  10^/10

  healerdropperevasionpersistencetrojanmysticredlinenanyatuxiuinfostealerstealer

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2