Extracted

• • Target

    221a018f5160e608effb19ba3143bee3d2e29489c2f31ea64185a8c206c42778

  • Size

    1.6MB

  • MD5

    7786789cfc86e1201383121f776645a8

  • SHA1

    58b51f4aa5a513a02282f38f2aa5e918f70a0af1

  • SHA256

    221a018f5160e608effb19ba3143bee3d2e29489c2f31ea64185a8c206c42778

  • SHA512

    15fe50f1a9dec0b5468c5f1caadf8597cdb945f6574eff86e1edf6e22c8c7b37ba307d6c7dd8d385f5f35a9aa9bd3763a7e2219102c07a65954d92a56e1782f1

  • SSDEEP

    24576:Kys8ZHGYG8AYj88rEpwKyVWGqBkP+lzZ/KxTejexnrLmSf4UqsFspsUhyhdLNnJ:RVcY48w9gEk+d/KojexrLmSf45e3X5n

  Score

  10^/10

  mysticredlinegigantinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1