Extracted

• • Target

    c896da83e1d0596134b319d042b835f2c5df5fd3ffaec7f6976709c8d82420c8

  • Size

    2.5MB

  • MD5

    b710166cd676f639c4dce70e6f3a76b6

  • SHA1

    b9b1aaae4e3abb4d411442e194f2b0c7a4314c4e

  • SHA256

    c896da83e1d0596134b319d042b835f2c5df5fd3ffaec7f6976709c8d82420c8

  • SHA512

    4cac5fb1884186bafd43032c69ed4e558199929f33e91eafb66e3f0cc049175a7de31382fef5ef2476cda4fbabc188070008568f5957380cad3c9b320bc551ad

  • SSDEEP

    49152:hjYpmMinpiMUZ6a3v2A9f8MqOsYYjfY8g6M8Gel:hjYpEUgKf3sYOfY56M8G

  Score

  10^/10

  mysticredlineramoninfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2