Extracted

Extracted

Extracted

• • Target
    jaffacakes118_7634c6c6b4a3e54acd58afade1f24e9e378fa3c0e157262eb8861c2d5c7465e2.bin
  • Size 1.7MB
  • SHA256 7634c6c6b4a3e54acd58afade1f24e9e378fa3c0e157262eb8861c2d5c7465e2
  • MD5 9a61671477b7859e3716398b73ae6fd6
  • SHA1 75bca2fcbc5d9b40de03844c0824d8cf9ee2ef3e
  • SHA512 652241508e06a9ff96faf3b65d45a7d1dbd629601af2a69c0437a08a739aeec0f82d9e02a565c30ce94e71dd8bfd1adf837d58bacc44610049fc50ed7c59f2af
  • SSDEEP 49152:UBNc9L5A1o7e6ZugWwPPzojdedsQg9yknINIcn0U73:ic9L5A27NNZPzoposr9yknINXnh3
  • TLSH
    T17D852382EAE84073D9B31771A5F73583063ABD91ED31426E3B58490F4EF2281A93576F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  04d170daf753frantdefense_evasiondiscoveryevasionexecutionamadeymysticredlineinfostealerpersistencestealertrojan

  • Detect Mystic stealer payload

  • Detects Amadey x86-bit Payload

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1