Extracted

• • Target

    502527781816a65e9954ad78ee65130cad862efa3ecb2675a709e8feb8050fa8_JC.exe

  • Size

    1.6MB

  • MD5

    3869bcab8c9c57d49e455c0adc1050e7

  • SHA1

    430d3208f7716c1c3955d2551e7542f37b1779f7

  • SHA256

    502527781816a65e9954ad78ee65130cad862efa3ecb2675a709e8feb8050fa8

  • SHA512

    fa50e8fc59b797476ded372db6d056667faa42b8ca3492cd9e17ed851006a0fc462d891d28405bca66dd6d6986f754693e9306abfbb2eda2a7484eeb0962c663

  • SSDEEP

    24576:9yTgCKEovnZkU0pfQbX64WpTmH2JH3pNGypBHekrEJFgT8+/WiX:YUUovZk06/pTO2VpNGSejF6

  Score

  10^/10

  mysticpersistencestealerredlinegigantinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2