Extracted

• • Target

    2480d7f032590fa543d88425207fc62153bad34270c83ce3cc416062c83dcad7

  • Size

    928KB

  • MD5

    6e673ae00e69a3eeed8c2c6626217230

  • SHA1

    e16d04dedd4059caa43748fe3657767462b03088

  • SHA256

    2480d7f032590fa543d88425207fc62153bad34270c83ce3cc416062c83dcad7

  • SHA512

    f33da6f2274840be105da7e00e49b4f3cc73a106ab54d2db4219be3b832f7cf06ab78f27a6860338bfa3666fd22581e9d8c66914c3c93283ad869885fbf20e20

  • SSDEEP

    12288:DMrqy90R87x+hnbg1dXirt9VzigjZ94hAB5nX9VYdnQknBFwbs8Q8b5LPax5rhJn:9yR78aiNvNMQkHP8Narj+SSAQvowIb

  Score

  10^/10

  mysticpersistencestealerredlineluskainfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2