Extracted

• • Target

    40aa442f42d41589d006a2e3e3f5a557d6c1a99eb3ea05d49d810f96ddc4c4a0

  • Size

    741KB

  • MD5

    28344341ea474fe839724bea49da07de

  • SHA1

    a34505fc8fafe00a942083bd12308959bc8103a3

  • SHA256

    40aa442f42d41589d006a2e3e3f5a557d6c1a99eb3ea05d49d810f96ddc4c4a0

  • SHA512

    73fb0a6b77a214147d3a3a5e95a27a0d83a2f81594f3520ea0a7604856603b6d7053ed9f85eaebe5f47bdedadf6fcafb003abb2897f96d216376b8d37a00372f

  • SSDEEP

    12288:YR//yfYb5BIQZVtYVPZtQNdZ4jfylbKtgETFz5buK/UZTSwb19:siuBtZaZtQHchgEh5L/Y3bv

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2