Extracted

• • Target

    6195881d4274b2f1344166270bf18a474d63d9bed07a4640e4824735791131d8

  • Size

    1.2MB

  • MD5

    91c4eefd401cabb1ad0ed77abd7d1fbe

  • SHA1

    4cac73bb08b3a17c23e17ea105a6de8ea5469d20

  • SHA256

    6195881d4274b2f1344166270bf18a474d63d9bed07a4640e4824735791131d8

  • SHA512

    00e32496c97c61b0fbba986b90c2ea289f4b7cb0e8955acfe1fb2f65a450e46609ea02091d26bb70b9f8f2e5933dc6225ccb5f906fa0cf59a11cd22b277d74e4

  • SSDEEP

    24576:ky0eFURdNqgqmeSys4QBCbz6sE5ftsei3dkB+7RAtsmsMDVQ2WVld:z0ewdoRmKsYz6sE5ftsei3ag7RArHfW

  Score

  10^/10

  mysticredlinegigantinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1