Extracted

• • Target

    7f2cc76276f40703761f1aa44309e0fce6ed0e8d9c2a8b146b31f6483b7222ca

  • Size

    742KB

  • MD5

    2ea88d1ecfd24025dfa9e35849cadcba

  • SHA1

    3b29499b52efad983ce96cccd9e557e612024b10

  • SHA256

    7f2cc76276f40703761f1aa44309e0fce6ed0e8d9c2a8b146b31f6483b7222ca

  • SHA512

    86da2851db4d4db23d8b20922a1e9b741c982eb77ca53205c43834aa9b699f9f71fab4000bdc91cc1019d3ede27b511ebd9919218a5cdf39863f37aedeaf88a0

  • SSDEEP

    12288:kR//yfYb5BIQZVtHPs9eQU9pHaO/RW/Bj4z0sNQ26HFCpRk/uIBaFCSp6VihvT9:AiuBtZs26O/RyglN6Fb/4CJa

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2