Extracted

• • Target

    ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0

  • Size

    741KB

  • MD5

    c18668c0214ae3c707c0c23da80018d5

  • SHA1

    5ca26749c7a266e1f45d7e009a96ba5e7a37abdc

  • SHA256

    ef0529d0b1be347ab3dc4d572ab9f67c58c0e3c5b248fb74de4b4474a9eefca0

  • SHA512

    f5da9dd17e8569befc476504b6c9779d7bc3b48cfcbc54ba7f65b56de99d79cb6aafb1b8579679bb397265b2eaca4381c401ae90a22b3ef8ab9464c064fe54af

  • SSDEEP

    12288:z8//yfYb5BIQZVtA3F+FRRUiXI56cCFqOkPuYsDNuWWgwzya7NFoG0LE9:YiuBtZVXRULIFqOEuYM+gwzvroGz

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2