Extracted

Extracted

• • Target

    be443d0b70edf0e8c9d373b4c7b50c2eb268518930333215ecfd847542d9c0d6

  • Size

    938KB

  • MD5

    95a9952fc3b0f6dc60e827a235402f2c

  • SHA1

    ed3d64ac753c8a3bc67f883833fae4f6c72f251f

  • SHA256

    be443d0b70edf0e8c9d373b4c7b50c2eb268518930333215ecfd847542d9c0d6

  • SHA512

    f06ef467ab5de8b021d8dd3e194caa032a48893f0516fe9745f3298953b030e4eb5e57cb575f9850790eddedd6f7f744d32f803df50527e87cc8481c2b784903

  • SSDEEP

    12288:ZMrqy903rObxYpP6o+XMTk5Nxu8Q+hW1Gavchieak8r2KqRiekI/srJtxJ18BCep:3yCr8mEo+cTQxu8Qzoa2uaKqjSJcR

  Score

  10^/10

  mysticpersistencestealerredlinetuxiuinfostealer

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2