Extracted

Extracted

• • Target

    f4e165022662a0844d08978d8f46b8ac05f23f0df6a3de7a1f9a88c07040bffd

  • Size

    928KB

  • MD5

    a54f16b41f8a25381378eb8ef8ab2e89

  • SHA1

    7c3811b0989967f66f8d51746817d3cc81c7e510

  • SHA256

    f4e165022662a0844d08978d8f46b8ac05f23f0df6a3de7a1f9a88c07040bffd

  • SHA512

    562e2dbe5c6e6531d5192898ae697eb96328605219a175699010cbfbc2f28df38de1c1af6d1f172b635876408e396d56abdbde26ee2a10423f02777242dedd99

  • SSDEEP

    24576:PyiByvm28y0TuN8kWJret8P5o9I3pjd30:apYTuNwe8Pa9Aj

  Score

  10^/10

  mysticpersistencestealerredlineluskainfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2