Extracted

• • Target

    12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282

  • Size

    742KB

  • MD5

    65da09996daf86723200abab2fe4ed5d

  • SHA1

    624a24c6cf82ad8fb48494959b4a7656fcd1862c

  • SHA256

    12fc411362fbf7db2790399c07452564ed99e472ce5da3dbcce6d6ada8171282

  • SHA512

    859f7a41ad6d4a055d3d09f72d2028ab4dc8185fe7149ed04c9f4d1f4fae40b0f6ab169020e157c6199b8337ae09427f332565ba3b424db4541808d0a26f7813

  • SSDEEP

    12288:JJ//yfYb5BIQZVt8keGlm/KJiYRVSpaLl5UubFlLT49T95FYy/n1K4SiFdA8pN9:riuBtZXeGgCNRVSo7FlLmYcn1KedPV

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2