Extracted

• • Target

    35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122

  • Size

    742KB

  • MD5

    54c5c31aeedfec77556026ade8842c8a

  • SHA1

    ad6aacf4aecfacb6b62d6889e17cee3b4e85af4f

  • SHA256

    35562ead61c7492e5bc22fae61d89e8e70cd5e51b291fba1a2e123527340e122

  • SHA512

    68607873f0104e2eaa9c7b2f3aad0247b59f5cbe1243c3491baf29843ffabc61bd86e1e40db65636ee3391f130e40836c5d605c0a3b442d7930dc7a58514223c

  • SSDEEP

    12288:4r//yfYb5BIQZVtl+PYLaVsXzcYKk8KimW+lU0NypfhHHzhL43nZI9:2iuBtZYvVsXXKnKiJ+lUWyZhnzK3n2

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2