Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    c591c07eab4cc217b5c2fcfdd91efbaef9c1d690301d148ca96b711a7d78e82e

  • Size

    1.4MB

  • MD5

    56e65ca2ac8fc65c0762f7aea77a659a

  • SHA1

    84fb947be105ba1d2b1682ce7f55c9421e0e6cf1

  • SHA256

    c591c07eab4cc217b5c2fcfdd91efbaef9c1d690301d148ca96b711a7d78e82e

  • SHA512

    624d5489ba1f375753e32647a70a3e84a4db1fc7df59550b85e4002de0c63d59e3b716f3606698240bbaeb81a39c2456633a1d47404b43ffb73d1a97eeb653ad

  • SSDEEP

    24576:5Zt/KQKRbTr9BRfYff0QvUv0rfieu9Aa1Ckb6CvrzHM8VzvppY6YNbhZ:5ZtydRbTr9BRf+6eskXkNpY/hZ

  Score

  10^/10

  amadeygluptebahealermysticredlinesectopratsmokeloader5141679758_99@ytlogsbotmonikpixelscloud2.0backdoordropperinfostealerloaderpersistenceratstealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Mystic stealer payload

  • Detects Healer an antivirus disabler dropper

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2