Extracted

Extracted

• • Target

    eb6569372bea1728e8d948eec1dc5951979169b34e336d71600782c4e2be946d

  • Size

    1.3MB

  • MD5

    c2f8dcc46cacf2c051679fa499d37df2

  • SHA1

    6d0394a3eb223dfbcb550d3641ce98a5958ed54f

  • SHA256

    eb6569372bea1728e8d948eec1dc5951979169b34e336d71600782c4e2be946d

  • SHA512

    150ef20224293a2485fb920c1cea90f43c6a20d8f1b2aff5e1464ddc59fa5bfc174149af7ce6e489e279b99ca5e2c57677f5ac14782eb6653b1f79f2467c0d93

  • SSDEEP

    24576:Ny77FK2F88LDBWDp0xDMpcWrGr7VUBIg53vko4zzphKT462NoxamMDkgbs/iO/:otK0BhOqNMp7IVu53vfczphY4dN7LrI6

  Score

  10^/10

  healerdropperevasionpersistencetrojanamadeymysticredlinegruhainfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2