Extracted

Extracted

• • Target

    86e51ae159678e7f44444ac6632fdb3a5ae3cab29904340fa30f27a7a061f542

  • Size

    1.1MB

  • MD5

    81e4f3c1d777b459d032c70025768e67

  • SHA1

    95204e1f301320603cbbec22caf56065044b9317

  • SHA256

    86e51ae159678e7f44444ac6632fdb3a5ae3cab29904340fa30f27a7a061f542

  • SHA512

    18d62da05813f8b96ef7fa7394f58f98cedddf410db372fef23c9ee2ca7577f02101ae33ff6917f50e182dcbc8bc9ac6e9ebcc5adcc337029aac81976fdf2d86

  • SSDEEP

    24576:JypikditgQk9LGXZOpCE0nHc8kM9WMiWi8W7/PrK/MPiKGhPnW:8pktU9GZOp6HZvkMiWDW7nG/MPiKGhn

  Score

  10^/10

  healerdropperevasionpersistencetrojanamadeymysticredlinedartsinfostealerstealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2