Extracted

Extracted

• • Target

    a09c8de6b1354ee1789d59804de40af3d1ee78ed9bb889017b83f9bd308d2271

  • Size

    1.1MB

  • MD5

    d826efe3e25a803d6fe2a9eb80b708c6

  • SHA1

    4e0877b603cecd3ffbf93516ce98928d117616c6

  • SHA256

    a09c8de6b1354ee1789d59804de40af3d1ee78ed9bb889017b83f9bd308d2271

  • SHA512

    f9ff05380da28669bc1e18a8d5538ccc88a7727eb8ba38547604b88f875d8566298afbcbdea354ea9458781523bbf62e07036f368e07c546175adc5075c00f0d

  • SSDEEP

    24576:ly3HdOcBSU2fBx8BwaCQz93mOdGuqcIY/xheyy1U:AtOuwJaCoZmOdGhpS2

  Score

  10^/10

  healerdropperevasionpersistencetrojanamadeymysticredlinegruhainfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2