Extracted

• • Target

    f084b3624a41bac023b6437e6678de792de424c46c764d3360b9c399c7210706_JC.exe

  • Size

    1.6MB

  • MD5

    fcce4ea188b31090a307f92d0b6e99a8

  • SHA1

    3a881b2eadeab9e8e74d650e4ab37e42cc18a811

  • SHA256

    f084b3624a41bac023b6437e6678de792de424c46c764d3360b9c399c7210706

  • SHA512

    4fdc0640c7c4de17774d61d8a96e76a0e90864f0ebfc5550738fb5aca55273764bafa8244b5acbab0b5a8178995dd172a88ddf7d2366890426a07c293214d03d

  • SSDEEP

    24576:UyrWsm669XVPuSBLMTp7jO75CY/XnYUfs5PcaWyOY4uRQdbZ566Uol+05L:jrWsqVPZMTp/E5CY/XYUfs1caI3a6U

  Score

  10^/10

  mysticpersistencestealerredlinegigantinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2