Extracted

• • Target

    54f5d693d882ecf2897fe9f2dc2a6747679b303de60a7199800c1dfb220129cc

  • Size

    907KB

  • MD5

    d616908509e9883f36385ffb9d9e81c3

  • SHA1

    486d67f400c41fe42c0edbadf1f7b1118fdca355

  • SHA256

    54f5d693d882ecf2897fe9f2dc2a6747679b303de60a7199800c1dfb220129cc

  • SHA512

    2f93b714aaba7b054f9673193084505c5da932031eecc668806cdabde9ed3349c9ddf02ff84276a0c43007494e3473b3367dc3113efc2ffdae7504df45ee3baf

  • SSDEEP

    12288:pMrty90qFZSi7NS6+OY04Lr6W7rmpJ+6nJOfpvDKJXx9mv9omv9sLVJ2LvKDs4UV:AyNZbNnqMHOxgABI2LALg4oQwaFs

  Score

  10^/10

  mysticpersistencestealerredlineluateinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2