Extracted

Extracted

Extracted

• • Target

    88f4a56aa3fbc6d2f08484255ed158c3abf324233bf4e7268e19556c8ed01ca9

  • Size

    1.0MB

  • MD5

    bc1ed13bc7bab353b19cb23d8b598e20

  • SHA1

    c6ecbba130c05c4b53ace7974a4eb8a62f27e12f

  • SHA256

    88f4a56aa3fbc6d2f08484255ed158c3abf324233bf4e7268e19556c8ed01ca9

  • SHA512

    d1043dabbebd2d0c3751435f8f0e6c998628605a40688a74897c70e1fb4918a30e1642b9cd993379c1673763a101fe111d023914ef80f58c72cb87b158a4bdb3

  • SSDEEP

    24576:VytoW1GZBe2cjBOuq6QFT2TWEomUIErNKAuoiyqzbB:wtoCGG2cg3twomUpSoi

  Score

  10^/10

  healermysticdropperevasionpersistencestealertrojanamadeyredlinetrushinfostealer

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detects Healer an antivirus disabler dropper

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2