Extracted

• • Target

    37e5c43c490a6a0c4d0c6345f07a69ef.exe

  • Size

    802KB

  • MD5

    37e5c43c490a6a0c4d0c6345f07a69ef

  • SHA1

    310e97e1dbe9a6c854a92fe0df453f397288ca6e

  • SHA256

    12fb005f8400051a07486a0b93e1429ec4db0ac2575d9eb1630e7d804813d60f

  • SHA512

    dd2d0b1834dde0009d5b58153d91f2292f27ae73f4d5e750f78fa0c8807393df6632f87351e497bfc8cc1fbac29e6514203db7f34dd79a87c037b518a5b60925

  • SSDEEP

    12288:PMruy905bnvC7qQJAYscbZdIvmmFUt+4MTwMsQrn14qtY8JmLgIuPR2UHtYsbTT1:pymvCHpxZdIvlQxSsQr14KJmLLO7e8J

  Score

  10^/10

  healerdropperevasionpersistencetrojanamadeymysticstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2