Extracted

• • Target

    6313afd8f6cb96b6ee1c711caf19a2b65a0ed947234a439c766e814ffc82faa9

  • Size

    2.5MB

  • MD5

    1972a38c64500f6c3521772076eb7e99

  • SHA1

    e35cced6e2af1107757eda3ec921bfb26fe9da6b

  • SHA256

    6313afd8f6cb96b6ee1c711caf19a2b65a0ed947234a439c766e814ffc82faa9

  • SHA512

    59df626d22684397c70b9ca1795a43c3602c2c8c3dbb5b5a075bacc6c7c967c8a7bfbe0929a4e5ef2a9233f55e845a3a0b8a97987633ec0be84291a8d6b96bc2

  • SSDEEP

    49152:f7YpmMinpiMUZ6a3vSI4A1vtIAt8ir3niFMIXK+F:f7YpEUgPJApG03niF

  Score

  10^/10

  mysticredlineramoninfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2