Extracted

• • Target

    0f8dad9bd2936d342978ee8646d1a61f1ceb199b29f87593139e16e8b76afc7c

  • Size

    742KB

  • MD5

    77b1412a26dcb1e794fcc91750f6d616

  • SHA1

    637b78b6db9bb2dc5bbfdc798b9a968a6ed9fb12

  • SHA256

    0f8dad9bd2936d342978ee8646d1a61f1ceb199b29f87593139e16e8b76afc7c

  • SHA512

    ca2db54c592efa905fb350d18f9152691802cfac19321a3a07f6ced5c064d94390c0b9d4a01b9b54ae7b11a85e2123f500ddd5deab0bf881bd80a7176dfb524c

  • SSDEEP

    12288:e3//yfYb5BIQZVtMPLHzavXjNxPV5FSHaiFRGG86njlgSmWBICBubNRvmrOs/C9:MiuBtZKzavXjV5gdjdnjlgSLILbNMOse

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2