Extracted

• • Target

    4ba2694fd56d0743b005f0bb911563c4b70f06aaf2ad9e97d38293fc2574f02c

  • Size

    2.5MB

  • MD5

    f4dc163b9b455dc7170c0818f3e531e2

  • SHA1

    7e6010d3b08776c7cfb73230bab80cf751ad0328

  • SHA256

    4ba2694fd56d0743b005f0bb911563c4b70f06aaf2ad9e97d38293fc2574f02c

  • SHA512

    397de2905f08ee3ad1e4927e659e6bc7607cb007212060cfd0588612eafc3f501c09e9dfc76223c4e028b5b8cfecc1013fb4f156dfd09cbf71fa262230e4b6e2

  • SSDEEP

    49152:BDRodsK5RBgEs6a3vWyjstJZhAtkLbnV7Rx:BDRocEL8srZEkXV7R

  Score

  10^/10

  mysticredlineramoninfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2