Extracted

Extracted

• • Target

    4f3cba69b3d1e7b1752691f9d3e60b8e6a682469118db59d94a4ead27b98f55e

  • Size

    866KB

  • MD5

    11248999fadaf8e95380b9597467cc81

  • SHA1

    ac00a2818c5512c10ba05f560007601a09270506

  • SHA256

    4f3cba69b3d1e7b1752691f9d3e60b8e6a682469118db59d94a4ead27b98f55e

  • SHA512

    f6cdb1c3f03e001fed44ad00f037801a84105eebca95c632bcc3cb7e63af73cb80dd3b9b34a4158d705774d1afa5a7fa533a53eb9e341c739fd19d520b49b34f

  • SSDEEP

    12288:DMrcy90Xj9CS4b8bS6rZbIl0ORsX78W3Ob9nUwk7rsGQ6YYfssQdsss1Xmxm:HyC9C8trSzRsJ3Ob9nUVOXhdsbXp

  Score

  10^/10

  mysticpersistencestealeramadeyredlinegruhainfostealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2