Extracted

• • Target

    d566b6edc900ac2531c5c6703ff0471ed1e618473d9690e82ff9c72f16011dd7

  • Size

    741KB

  • MD5

    9cdd134b8345aef99fa4e75aaa6a1131

  • SHA1

    0ed1dbd69ae5ffbe63f0d52951e9e84dc54d42aa

  • SHA256

    d566b6edc900ac2531c5c6703ff0471ed1e618473d9690e82ff9c72f16011dd7

  • SHA512

    f765f41a703c63087bd08c00a35b6da2857358ca0f18b417bee8e4709310e13b90b87fff6a16202d20e483b09a461e140ca044817ad8f523b3cd98721c80aeaa

  • SSDEEP

    12288:tW//yfYb5BIQZVtP1DR/1STHZrfaVHmtGtukSr4KLe5bAwdLlsbe2whFoR9:QiuBtZA5rfgHmm9SrxmfdLmelQ

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2