Extracted

• • Target

    3165ce83f61e0ca5e10b4636e88c82eb79dbea5028c60cda646b1d22bdede78b

  • Size

    1.0MB

  • MD5

    0cd42e6a819c6e0f4871b4a9de267a02

  • SHA1

    129e3fff137fb270b1e936071e3699ad1ba94ca3

  • SHA256

    3165ce83f61e0ca5e10b4636e88c82eb79dbea5028c60cda646b1d22bdede78b

  • SHA512

    c972086d80895e40be30c41af73d0ba56a894b49983ce26790aa319b03d15a216c49f5a71fa9bcc1eeae90c73b64933f33e5a57e35076ace3c75e6c741bd1dde

  • SSDEEP

    24576:VyD1DeCByCxL15m/1MEiEiEwE80zwLZw:wD1JByQi/eEGEplg

  Score

  10^/10

  mysticpersistencestealerredlineluskainfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2