Extracted

Extracted

Extracted

• • Target

    9e82e946f2ad435de04e68e4dcc4fa943172de889246ed74cb6a796528bfcf24

  • Size

    1.3MB

  • MD5

    aa0ab0d21269b78f1c12da96a416a629

  • SHA1

    9e08ee5b2059aed4ec603f291d2ccca9e5b66ec7

  • SHA256

    9e82e946f2ad435de04e68e4dcc4fa943172de889246ed74cb6a796528bfcf24

  • SHA512

    cce90cb12afbb7e634ec42d10b5fae5950b73bc97e4f097df60f4f87df53b49595778bbf75be6a459e6d8328196a47620383c257f306df3ca260fce924b19eb4

  • SSDEEP

    24576:zyh8Hhbok3i/nj+HXHAcGf63GmXtXXJjWi2bbE:GaHhbosiIXHAy3H9XXJjW5v

  Score

  10^/10

  healerdropperevasionpersistencetrojanmysticredlinedartskendoinfostealerstealer

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2