Extracted

• • Target

    25fbc20dd4b40ed07d1691903297eb73e785a9126d433eedbc5331155279a77b

  • Size

    2.5MB

  • MD5

    d9491359a3845517e5d67bc3d36b183e

  • SHA1

    3c4622f487089e5b3df6d638e1b38d7ee6d4a659

  • SHA256

    25fbc20dd4b40ed07d1691903297eb73e785a9126d433eedbc5331155279a77b

  • SHA512

    9fbcee3ad377de0b38fb5987b9ea6b4749f05996bca5e4e2d3be9ba05b137bd106e51cb10476b9ae119c476fa037fd2cf7848537642188613555e3aef3ac7ef6

  • SSDEEP

    49152:cQFzhEmxGrFGX6a3vyiHs8ZqejYPr/If20yD1q:cQSFJHRKEPc21

  Score

  10^/10

  mysticredlineramoninfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2