Extracted

• • Target

    60cab3014b05ed8fea9e2be10cf833834c14d2184abbb754498ba36043d36772

  • Size

    907KB

  • MD5

    3ac63f44e31d4d7e78fc11853827282c

  • SHA1

    13fb3b5448d5d9641ea6a9416ac1712fc4ad4ffd

  • SHA256

    60cab3014b05ed8fea9e2be10cf833834c14d2184abbb754498ba36043d36772

  • SHA512

    3e77cd94ff13b7ddd931294129e3368ede1c0474e1cf5e4df041c6eafe5f2fa1e09d02ff1403a0dd35b778875e2770f18ea2ba0bb96f488d630d49ce0a6bd775

  • SSDEEP

    12288:/Mrby90kLRsfKdMbGJW/4UCTIQTeODGL/PYX0OqOJ5ICEgur6UIIVa88zhHkFwg4:cyrLYKdMgW/KpeOAP+0SPIheU7UuU

  Score

  10^/10

  mysticpersistencestealerredlineluateinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2