Extracted

Extracted

Extracted

• • Target

    c5f12486ebaa299ed804fe39daaf5eb90a0029d1b6ee98d9426b42978aa2d3b0

  • Size

    1.2MB

  • MD5

    d39abdaaca8428711f4a6900509ea1a4

  • SHA1

    d05ac2ce9780adba4300b1cad69799db443a6a70

  • SHA256

    c5f12486ebaa299ed804fe39daaf5eb90a0029d1b6ee98d9426b42978aa2d3b0

  • SHA512

    70b19749419ca07fe09d931bfc15b54f7e517ba42da3fd03411a7df34456f25943bb0b18566f18a6c48d272ae0a848828716b3e07ee9eb2d2c3f2d89f1b114ad

  • SSDEEP

    24576:VyuvuF0ZJ5EgdXEYOhYeuymbx+HTr+xo3K+JdQrspj9QgKF9Ff:wNFUEY+IXbu6xo3pJursl2nF

  Score

  10^/10

  healerdropperevasionpersistencetrojanmysticredlinedartskendoinfostealerstealer

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2