Extracted

• • Target

    47008c4efa655e3849f6e0cbf17bb6a7bb420279bc07a2fb75d891e3e8db16df_JC.exe

  • Size

    807KB

  • MD5

    d619791077e170d00d9ede6a7d96c722

  • SHA1

    5ae1260a29fbd0600645f36a1c669bf0a5cacaf0

  • SHA256

    47008c4efa655e3849f6e0cbf17bb6a7bb420279bc07a2fb75d891e3e8db16df

  • SHA512

    5173146244e507df9e5cd5457a12d739a4e7dee24d4b0d273ddcd73dc40989b4d9197088e7c032d42f4861068457e8c6673faef1d46677d99431aaff98aba24a

  • SSDEEP

    12288:BJ85kfMfnuis006jmO7kpQ48+XIkrC/lCUWts/RW+TeyJ1NH3yZa3QJp:BW5kfGnbsNpQ4BXnSVRWoeG1Ns

  Score

  10^/10

  mysticredlinemonerinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2