Extracted

Extracted

• • Target

    fae95404497faf9030e074edd30643cf7be0463930133dd5854dda24953c29fc

  • Size

    955KB

  • MD5

    46b04882b80ff2f56d70aaf728ab9f20

  • SHA1

    b2d15133f3c90952dc029908e445ae44e4b860cc

  • SHA256

    fae95404497faf9030e074edd30643cf7be0463930133dd5854dda24953c29fc

  • SHA512

    3da63854224e19f14e81645c0831fa9b9335b9d68e4ab025c5523253c85f27a874b1aba524e828e55dbad65cdd9627a95d5c434114eb86cfea0cb6c5a427531d

  • SSDEEP

    24576:MyzC5tECcHiu7+rOE8nHitkT+BnUsw/o+tg+y:76ERpK6RHitkIwwA

  Score

  10^/10

  mysticpersistencestealerredlinetuxiuinfostealer

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2