Extracted

• • Target

    9085f734e35e609d36a6419dbe3971a712fd17e114249a3924a44bc57ca9af79

  • Size

    2.5MB

  • MD5

    bc662b9f4a4d532ad2dbceba21f44d11

  • SHA1

    bdfae10c8b50adb8d4e92d487e4ba69345bb0df4

  • SHA256

    9085f734e35e609d36a6419dbe3971a712fd17e114249a3924a44bc57ca9af79

  • SHA512

    a228294ea7836fc975dd563f1db42e9d8a11fe3f3bd2788fc5ed7df9f56e7a33c4437f3a29a18dd588355fe02c5ab205bde6b6a1b00f10c3233a446821fd8f90

  • SSDEEP

    49152:G9RodsK5RBoEs6a3voe+EGfDNvr/CR+yg3eIffg6:G9RoUELl7/fh/wAfo

  Score

  10^/10

  mysticredlineramoninfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2