Extracted

Extracted

• • Target

    8328c211c3b4fa61873d7cb2d1e4c39d5ed13549f0c82ebbc12c84a14f022b32_JC.exe

  • Size

    1.1MB

  • MD5

    e4fe4d1ca19c2cad87cffd6b0901a694

  • SHA1

    c8c1449bac2c3e82e58841698590ec3393755aa3

  • SHA256

    8328c211c3b4fa61873d7cb2d1e4c39d5ed13549f0c82ebbc12c84a14f022b32

  • SHA512

    886f3fe924206f8985ac4749cb58f1ceac7c52a4067fd5c07a0da6b2a3b46b9a5c92aac04b2dd373796676815ac02951635c8c7c5584dec70257516dd4917197

  • SSDEEP

    24576:xy2KXuOp5d7QoNdzBcouCRP+nJpOTH5WiwzTYmwYDrO3Bnww2+9:kPD6g+JIHUjDrORn

  Score

  10^/10

  healerdropperevasionpersistencetrojanamadeymysticredlinegruhainfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2