Extracted

Extracted

• • Target

    7ba3400264a22e6e314babc5d2ee86b66bdc3a377b80a8c86e3fe98653314c0f

  • Size

    867KB

  • MD5

    988994571a27ad64fac33a99ad999c48

  • SHA1

    62f33be638d0540dcd16ce8f1ae98056b673e7d0

  • SHA256

    7ba3400264a22e6e314babc5d2ee86b66bdc3a377b80a8c86e3fe98653314c0f

  • SHA512

    074739fe7d125c62ad2d6fba26c262b24ce36ca351184a2b3d533b210d6492729aca487ad3d205ae52cfcd3e3c96fbd08e8277c46f6197d6b21b509b14952d59

  • SSDEEP

    12288:rMrsy90oNON/RkxBBEFpvP9AaF0aOOkXglX3DIJy0chyeXweZaTkQfRFl+cJtAa5:zy3NOPPfO1XglX3DvIDJv+cJtACnf

  Score

  10^/10

  mysticpersistencestealeramadeyredlinegruhainfostealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2