Extracted

Extracted

• • Target

    b0cd60e59830e0d9e86ce5c9a382c628fd2c2e68c7323e82b795afd0678b137f

  • Size

    1.0MB

  • MD5

    4974f00ab78a24cc927bebd02e889e1c

  • SHA1

    aef336f55e3a99c2a9f06fad2ce86917a325a187

  • SHA256

    b0cd60e59830e0d9e86ce5c9a382c628fd2c2e68c7323e82b795afd0678b137f

  • SHA512

    79ec05228e97ab6b8cb7ef66c0c70ac2869f81d29128b6b6312d870006728841c27db98655f40252bf624a1ff65b54b6f4e5a9cfb674911af4c7e8f2703bffd7

  • SSDEEP

    24576:uyt1Qe5Ee8zTEEWPpLv/hMZ6auCL0hXJkMN1u:9t1l58zVENpmpuCL0H

  Score

  10^/10

  mysticpersistencestealerredlinetuxiuinfostealer

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2