Extracted

Extracted

Extracted

Extracted

• • Target
    jaffacakes118_d916a16eca141685dc128e8d726d5eae24202ffe9737a1f80b496d1bd6f11ecc.bin
  • Size 1.4MB
  • SHA256 d916a16eca141685dc128e8d726d5eae24202ffe9737a1f80b496d1bd6f11ecc
  • MD5 fbdfc3ba820672bd5515398d481675d6
  • SHA1 224cac9881720f59dbadc7dfb6f3774fc99ff6cf
  • SHA512 d52e5b9447028e3b7a44d1ef3b19ca8b0ed1f8a346dde87ce67804288baa303ffaa76a0b873ca38fbac3e266f453056360b800f14a90f673e8da30760074fecf
  • SSDEEP 24576:7XSiHdm7u8vnjE7raUrV10CRtQOdS2Bi/TUHbNZDdTN9+YodOLOCnZz:Oi9mZzUBVRtQ1Mi/TqhTN0Y
  • TLSH
    T16E65125078A08836E47105734B60CBB85A7F79300B19AEEBA7D45F6ECFB12D26E34D61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordaf753fb0fb8tucodefense_evasiondiscoverydropperevasionexecutionamadeyhealermysticredlinesmokeloaderinfostealerpersistenceprivilege_escalationstealertrojan

  • Detect Mystic stealer payload

  • Detects Amadey x86-bit Payload

  • Detects Healer an antivirus disabler dropper

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Family: Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Family: SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2