Extracted

Extracted

• • Target

    9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670

  • Size

    1.1MB

  • MD5

    a7d03b76859e68022d6e607ce2231599

  • SHA1

    fc85348d5a1f2c83602b68f8779d0e730e25a212

  • SHA256

    9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670

  • SHA512

    39dd00949f684f54ca4281cffe379590b1473d90a052f27452018b7996214ea90697dd994ebd8aa0229b8ffb6cf767b63513a66570d9e343550679616115b505

  • SSDEEP

    24576:qyCgx54gqrKq2/SSg2THTnu7Pyn+yW3Mu2SMTerrBEvF:xb6Kq26SnTy7Kn+D3VJy

  Score

  10^/10

  healerdropperevasionpersistencetrojanamadeymysticredlinegruhainfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2