Extracted

Extracted

• • Target

    4eb83e5f4039efe9296d95f59b3a2cd5678c22007cf270b8a65b6b58ac2e0e52

  • Size

    956KB

  • MD5

    ad9a050a806ed357ebdaf7645f7d956a

  • SHA1

    60559c8131a5ab066d8681316c0eabd5c292a3d1

  • SHA256

    4eb83e5f4039efe9296d95f59b3a2cd5678c22007cf270b8a65b6b58ac2e0e52

  • SHA512

    a1e96a27e43da3ec87d660293b20cfffc428783c1435729b5c6e923c9ccd8e0af38431d8bcbba0cb2072bda18116caa9c3e406133552981a3a31cd3d11c46a50

  • SSDEEP

    24576:py7fbHnAbhSHhHJhlADjiaKvtcpu/3JDksmw6d/b1Jrf+yKo/hV:c/HAl8hJhlSjMj/XG/LtKo/h

  Score

  10^/10

  mysticpersistencestealerredlinetuxiuinfostealer

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2