Extracted

• • Target

    5ba43e62edf10c7a671fe3b99bc0856a4c957b983669f2f2c61bcd6dbd0a871d

  • Size

    920KB

  • MD5

    38336c49f5d555690cd63f9be109c6b6

  • SHA1

    5211370f31c6e8f5d242ae76167033a38903af61

  • SHA256

    5ba43e62edf10c7a671fe3b99bc0856a4c957b983669f2f2c61bcd6dbd0a871d

  • SHA512

    484b44973b4cb9cb9e5f2b7f300b4da03f978d1f3660a97c4d5a8ace9b816cb68953c3805ed8a1255fb44c896224713f87c7bd0197c12ea9975609fb819d062d

  • SSDEEP

    24576:EylB5waeuIs2C/GZLYDViZOV6yaFFRaCKxY:TFJetHEGyxkOV6JbRS

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1