Extracted

• • Target

    708a133d091b246464e1ac8ab201a14fb9ce4e4cb4aa9ed7551fbfcb1baf16a3

  • Size

    846KB

  • MD5

    8669a71c1a9ab8195442a8690ebae18b

  • SHA1

    a4d95bc7972fe7124834748843fb95b904b8297e

  • SHA256

    708a133d091b246464e1ac8ab201a14fb9ce4e4cb4aa9ed7551fbfcb1baf16a3

  • SHA512

    4fc7a5e4e2cde830f81d155309bec9e8c67580aaf0fcd3bacc31df1db6f95f4fea18439dad399e152a2fc3a02ac277301cc5c98f3cd5647c20251c1974a9c656

  • SSDEEP

    12288:fMrny90WqdGteM+roKdsU/MJXC16a0CKmtvUmVmAI57GXETc53X/nVHmbE:Qy5MG0t8AsUca/KODmAQ7iEu/nIw

  Score

  10^/10

  mysticpersistencestealerredlineluskainfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2