Extracted

• • Target

    e35e93f9ca7731196ebc922e102fe9230fb6818c52f8c7fcbec24ba9c2df0847

  • Size

    742KB

  • MD5

    49d46cb81f01044f2563813d9ff41fbd

  • SHA1

    9c7f2e414f91b5b4a06a47491e079d8510b36fb9

  • SHA256

    e35e93f9ca7731196ebc922e102fe9230fb6818c52f8c7fcbec24ba9c2df0847

  • SHA512

    86f2c9809b7c57d6320c187efe735680a9641f60aba0ce62ba81e97d33064455610c3194f197a583296a7e0096aaafaa76cc223e07d60314817fe708dde3205c

  • SSDEEP

    12288:cO//yfYb5BIQZVt31Pi7uFqDIhN6UZeTp3HO65rRyLzmqnFFbsrVI9:7iuBtZtKoUWs5VO65rR0FbUy

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2