Extracted

Extracted

Extracted

• • Target

    83bb9757e5712811fbc18c52bde663b1fc8bf76d2ce7d983a9865373407b5bd5

  • Size

    1.1MB

  • MD5

    4c7092414c3ba90d7e5dbec284dd7b54

  • SHA1

    4343a3b4a2dd4ef5b0446a59239d648df1ea9fcf

  • SHA256

    83bb9757e5712811fbc18c52bde663b1fc8bf76d2ce7d983a9865373407b5bd5

  • SHA512

    a35f11a97a1bf3442490841b58b9ae0070ad472a55f3e9962344b896aff511a931d91b5c217e77ec387314c7f27a55aec9b23c4d8191ee39d7cffb5b01010623

  • SSDEEP

    24576:8yW54f9AF2JNZYeckpBS6WJfAMw5KOT8D24niyL0P3:rWWiFYjYgpI6EfNMag

  Score

  10^/10

  mysticpersistencestealerredlinegruhaloftuinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2