Extracted

Extracted

Extracted

• • Target
    jaffacakes118_26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984.bin
  • Size 1.2MB
  • SHA256 26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984
  • MD5 747dadd01cc80f35d9cad6136b9f7930
  • SHA1 dade225ccd02ba948b9de9e95af52eb7a92d546e
  • SHA512 c4b5b6480bcab9d5936cafb146d17fb96b4c903e861af23a49ce508cf5d9be701df28ee015beb4bc02dbbb17b7222357774a1e7d7b4200743b3818bb8980c582
  • SSDEEP 24576:leMCJ35/59uE6tIHPFX3faHOYt4OZqaqCvgu1Hg:kMCJ3VujtsXAOYKOZj191Hg
  • TLSH
    T17D451218B0D1C873D07215361EE59AB69C3EF9680A95BEDF23D91F7F0910381BA349A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  daf753fb0fb8tucodefense_evasiondiscoverydropperevasionexecutionamadeyhealermysticredlineinfostealerpersistencestealertrojan

  • Detect Mystic stealer payload

  • Detects Amadey x86-bit Payload

  • Detects Healer an antivirus disabler dropper

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Family: Healer

    Healer an antivirus disabler dropper.

    dropperhealer

  • Family: Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2