Extracted

• • Target

    42bfcabbc3a99b798769815c49eb3467.exe

  • Size

    942KB

  • MD5

    42bfcabbc3a99b798769815c49eb3467

  • SHA1

    88134607946f2450f346d1ebceb6a19e1fe31c9c

  • SHA256

    ce8dc4c62e02dca764fed40b84609e50dc039d0b1e4f5c5ad714ac00eec298c6

  • SHA512

    ce04e419da63bb43f3605a9cd03555091f527edd4be5a33e551702eb1557e2db32700c403a57689b9a2358d66b278a90d97d667a60e8463027776f455d5a4c57

  • SSDEEP

    24576:vyz14A0G7u3AH4elI8Afoxlz6VO3UUOj:6Z4DG7CAH4P8AfofuOkD

  Score

  10^/10

  mysticpersistencestealerredlineluateinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2