Extracted

• • Target

    ee361fa8358b6c102fd1cfd20f3eb6b3e1b7145729071be643b34863dc78c03f

  • Size

    908KB

  • MD5

    46af40167006031e7f96b2adb0a94383

  • SHA1

    b8b525365875535fe7c415046099999b8dd93d48

  • SHA256

    ee361fa8358b6c102fd1cfd20f3eb6b3e1b7145729071be643b34863dc78c03f

  • SHA512

    6d1694cc2e356da4e2a471e9895d9e9b9f537143260e430dbd34f3541ea99e745fceb83e5eb0c45d0ecc332d3b492f447423e3ab2978c8de3278578a005fa1af

  • SSDEEP

    12288:IMrXy90HGxpX+PYtyKMww4249MBHhDGD83vtWdwYQ8hjsg4Sg3BgAMzS4vNeRxml:/yDxZ1zYBiDegjX4SYMzSoNdl

  Score

  10^/10

  mysticpersistencestealerredlineluateinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2