Extracted

• • Target

    2b168dc536fc2abd0454840c703e55cf7a16d76f6a25af008b7fa32bd9922ba3

  • Size

    1.2MB

  • MD5

    937916150d8513b0b36b7ed09531a16b

  • SHA1

    7c7d32446134a5a83296843b1b1bc07a043e7282

  • SHA256

    2b168dc536fc2abd0454840c703e55cf7a16d76f6a25af008b7fa32bd9922ba3

  • SHA512

    f62dcf2e32c1f8336864ab1fe87b528da8db258770754a35f586ef74f6e9b83fa5afa99134ba0e0cb62ef2c02ecf78fb0924f4d418c97a213c104d0387ce7577

  • SSDEEP

    24576:JyjTyoLOOvQwWOa7OVVYowk042oi9He2RfO2BkNd5nvA1PZ:8XtjvQpOmsYnkQof2RL65Y1P

  Score

  10^/10

  mysticredlinegigantinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1