Extracted

Extracted

• • Target

    61644bcce864750f3af1b5c39da1af348c5a4a702ed85805c1c663f614c64e20

  • Size

    928KB

  • MD5

    8da4b22d846b94ffdbaf1dea73a8be7d

  • SHA1

    af916f4b7cc5a1b9b355e5df6838b1529e5b46d0

  • SHA256

    61644bcce864750f3af1b5c39da1af348c5a4a702ed85805c1c663f614c64e20

  • SHA512

    ff49b0ffade32c9fa7874dccdb7861c7251d34c4162175ce2c1aa40acff047e12395c7f8475a10f135eed8f953ce91add8472686c0080ac692c7ab80001d71cc

  • SSDEEP

    12288:aMroy90avo+Hz/gwHDWWJCNsAGwCaBFrWyZflfFeDqkzlDdVboKhfqhnXHlfc+r:my/LhwW0VvN/NFc5Vbxf2n++r

  Score

  10^/10

  mysticpersistencestealerredlineluskainfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2