Extracted

• • Target

    bd6fef397ae6796105ee058c1a9a49af5bb692c1fc7af6b95c0bde26ee7b437c

  • Size

    930KB

  • MD5

    0afdeaa56e8653a05bf26b5971c6b706

  • SHA1

    37fde8c74d9e009bee547935b9416b1158b486a0

  • SHA256

    bd6fef397ae6796105ee058c1a9a49af5bb692c1fc7af6b95c0bde26ee7b437c

  • SHA512

    549a81de6f413c1fded95145729fcc600041cd071734af803e73b6b1640ec3d3f24ba2cd5b4d49232578276c6aa9781844a55c2bbbf145da990a0ce309056d3f

  • SSDEEP

    12288:mMrKy90iQfYEaIcQSmGe9MG0/s0SyMvNsqeKEifISrzDKg8xC3e7SwYOgx3mQiqI:4yOUdeqGVyTKgwzD8qgZYOomROs

  Score

  10^/10

  mysticpersistencestealerredlineluskainfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2