Extracted

• • Target

    1a5c04bc113dc9fb566b9155ecf3f3b516af918fa84de5b5209bbc065f06ca51

  • Size

    906KB

  • MD5

    455be1685332e8e2aa8d42828e658bfa

  • SHA1

    869c522aab3fde3a4f3f30547f1f4d1b8a55aec8

  • SHA256

    1a5c04bc113dc9fb566b9155ecf3f3b516af918fa84de5b5209bbc065f06ca51

  • SHA512

    55a6cdcfd2472382936de6ec08eb16ba3226dbb5f7af4a4be803950e9ac659bc044f9404078e5b83196d301886052dfcc94d538036cc32d7565a8b3a19a1a260

  • SSDEEP

    24576:uy7cVEfhhJpIsg6MnhcmwCVKE8MBCom8VtuN/P:97cOfhhm6YhcCt8KV

  Score

  10^/10

  mysticpersistencestealerredlineluateinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2