Extracted

Extracted

• • Target

    14bc88936f16cc3e89403e71e28caa14e9adba4e0517f45c253bee216bce57e4

  • Size

    927KB

  • MD5

    29e8556f9a3b0da65e69a749bc7ba9f1

  • SHA1

    7a7d5b374792a76c0a445f2cf903dd839989ebdc

  • SHA256

    14bc88936f16cc3e89403e71e28caa14e9adba4e0517f45c253bee216bce57e4

  • SHA512

    691bea750d217024bd5810d8491d112f3b6dbe020220e120ccf35a451448c2f2ea74d0c519b284bd513f7f591c3f6f7fca54e207bf5b45d7c6e36acc03ce32bb

  • SSDEEP

    12288:2MrOy903S/L8GGyFLkiHWkhgUd6ghP5diqPZhW18dGLMDJHV09mdeRvgeuHh:cyCSD8GGyFgEGzYzZhP4MDJ69vR8Hh

  Score

  10^/10

  mysticpersistencestealerredlineluskainfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2