Extracted

Extracted

• • Target

    ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222

  • Size

    1.1MB

  • MD5

    8fbf1d99509e54ac8b85f735a9ab887b

  • SHA1

    32193019b419b3e025f1ae410904d4ec6571f7b9

  • SHA256

    ef37fb37e857c6f407d6da3760447679dfa2bcfea1009cfe9f367d8d1ec67222

  • SHA512

    7926b4b71180853a7bef35758a828c8ef3e4d0488e15fadb930b312c1afe7cacd94ae3d82fea1b1aefa6bdd2ebfa0fc6257473141d16efde427d32811c28df71

  • SSDEEP

    24576:jyYOGei01O9+fSBzKLaCvuFqqV6U9VuT0bWDXADQb3B:2YOTy9+cymnVeT0bOQu3

  Score

  10^/10

  healerdropperevasionpersistencetrojanamadeymysticredlinegruhainfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2