Extracted

• • Target

    3d5e19bb476f94f089702548a0995704cb530363dcd49e8f5a05e78645698973

  • Size

    942KB

  • MD5

    5e24d68c1ffd39affe7061e59a8a583c

  • SHA1

    8422a179fe6090389a3014eceb351e5153a673c8

  • SHA256

    3d5e19bb476f94f089702548a0995704cb530363dcd49e8f5a05e78645698973

  • SHA512

    b17fd556fe0121429ba261e80c29a8d8e9a7a1180cc68ca2909162bba7eaa444fa6b1c2d0c74e70ccee75b3da71e818d55af64a4c6dcf909fa45f52480111c84

  • SSDEEP

    24576:8yvXgJUdpAqUcHo7YzzGawjiYe7rbNu6ByL4W:rvQJUvAdgzVbzNu68

  Score

  10^/10

  mysticpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2