Extracted

• • Target

    d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942_JC.exe

  • Size

    742KB

  • MD5

    a6d704413ca620fc8e39e842cbb10bc7

  • SHA1

    91e5019955a9d7f9122a15c196da222263a11aa9

  • SHA256

    d6d9b97ef2ee005e81789fa0a6fa2cf5ba2f06d50db1f881a5a19bf987042942

  • SHA512

    8e089bba264ec9735e9cfa6cbe6b8bf9afeb2d43df049e707aa2c6fced0dd1a90a99bcd900e06099ba7d8b411fdd32b75d3a8261c8f34ca08f68166dd6a6e376

  • SSDEEP

    12288:Cd//yfYb5BIQZVtTddwNEflmJ1xq8n7mtPFxheiHX5iopG9OuTyfFuO9:iiuBtZ5ddoJ1tyxFxf0opG9m

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2