Extracted

Extracted

Extracted

• • Target

    42c6150a8e33b720e89825db2be6bc06d76190929c82d03324faa294ef3e184e

  • Size

    1.3MB

  • MD5

    3e6cc6888adf34693f8592cf1e727948

  • SHA1

    bcf6446d49fd822ed6768ca1afbc3556f477c55c

  • SHA256

    42c6150a8e33b720e89825db2be6bc06d76190929c82d03324faa294ef3e184e

  • SHA512

    6366c2f2d657b2816a6c64c05c714ed18ae1a45217b74832a9bbc52fbbb029a1c3e21290eee8eceae45eca28e0f0fa82c5ebf056accf3168341882087aeb2062

  • SSDEEP

    24576:vyr3bebwVRqrJcHffQvyRMhwt3uRge2YAPK23iyeEgw8ja:6rTea/ovsMuSge2vPK717

  Score

  10^/10

  healerdropperevasionpersistencetrojanmysticredlinedartskendoinfostealerstealer

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2