Extracted

• • Target

    8ed3ed8ae8dd31a991ab5e63e69161f502be26abd287705b1600b1d7122538c9

  • Size

    908KB

  • MD5

    29ee3db1a85d1a888c0059a7e4a290c2

  • SHA1

    f85d0a6321d53ce58ad759813ce9efe0d04b17bf

  • SHA256

    8ed3ed8ae8dd31a991ab5e63e69161f502be26abd287705b1600b1d7122538c9

  • SHA512

    762455e6bcbe264db1b99908a4fbe634c4ddfcfd546ffc31d223bbc6c3abccae17d31951335c81e0d8c24808ffd1a56f3a5e894d876e72308bfdbfc98625e166

  • SSDEEP

    24576:Yy7/kIqEv6hnRhwq9bIJiTirbKJAa8BhEGTaZAX4:f7/kjg59rbraWh3c

  Score

  10^/10

  mysticpersistencestealerredlineluateinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2