Extracted

Extracted

• • Target

    e1489e93fbb749c0856c8c46f588f2f6b779b4a14f03d2e88ebe643fcd9a7904

  • Size

    1.3MB

  • MD5

    bd67c03e8413964edd9588d0db400e46

  • SHA1

    2d602427a2e928ba5e82dd2fe9e457ce266ee18d

  • SHA256

    e1489e93fbb749c0856c8c46f588f2f6b779b4a14f03d2e88ebe643fcd9a7904

  • SHA512

    05c8809ae8e447cde4c0ef0dbc3fa2a81f008db71c14d8b405269c1f9d5f25b17b4fb59b1e90c2929646b42abd8ab532730d3809237e27d3a2ff0073e3e8b701

  • SSDEEP

    24576:NyjQKu+vC8zbP1k4sLLwSOIWF1o4+Nmpl6wWvs2IlyPF4/W+:oj1j31k4sLM1MmOtvHIlKF4+

  Score

  10^/10

  healerdropperevasionpersistencetrojanamadeymysticredlinegruhainfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2