Extracted

Extracted

Extracted

• • Target

    da51a9ae1d12b64fc33bb2fca2414c665d53fc35132c87e12090ea41891225aa

  • Size

    1.3MB

  • MD5

    d6294b2dd6604b3667d73143459009e7

  • SHA1

    8a45b687a07d2b1c8c1c99d4a60fd4f7fe932882

  • SHA256

    da51a9ae1d12b64fc33bb2fca2414c665d53fc35132c87e12090ea41891225aa

  • SHA512

    e23ca4692c6905e3fb8219f8eb48fd8d8270038cf81f85bb93cd89971dde826f2ec4aded2bf8bb0e3dc1a0f4091033ec07df09abf7afbe70cf7c3343b7bc30aa

  • SSDEEP

    24576:my2sr091VOjUH1vVt5A1WL/P/y5WJSZjvfXxs8qzyCUSh6yaNU:1VQEji1P540/PMWsps86xl

  Score

  10^/10

  healerdropperevasionpersistencetrojanmysticredlinedartskendoinfostealerstealer

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2