Extracted

• • Target

    5d8bb381eb06ca3d8e25903bfdd00a1864557abf3b06eb3a04465b2c89f81b30

  • Size

    2.6MB

  • MD5

    9c049717dbcb7f45aef3f2c2f3861bac

  • SHA1

    8a70cd67fc134ac3f984fec346e052d377bcf465

  • SHA256

    5d8bb381eb06ca3d8e25903bfdd00a1864557abf3b06eb3a04465b2c89f81b30

  • SHA512

    2ad5ef681ee3054c8ec5717b5228993383b885bb77f253bc11e701252d58cb8e4733cdb24d8264912a073634b4848f5c0f11d494b6d839df2597de41d2cd20c0

  • SSDEEP

    49152:gFVL193R79LdBdq06a3v0fa8dMpOkANsl4aix:gFVdYVasMpOkc1

  Score

  10^/10

  mysticredlineramoninfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2