Extracted

• • Target

    b05b5b5854ce0c5b00dca2d9cda190cccabd42550ee3b0353f3387472cc29e13.exe

  • Size

    917KB

  • MD5

    bd1eb9bfa4ea384e19d0d9d1413d3473

  • SHA1

    1061ef813c51e59b1bdd3dce80d506f9bb127483

  • SHA256

    b05b5b5854ce0c5b00dca2d9cda190cccabd42550ee3b0353f3387472cc29e13

  • SHA512

    9900fc86c53c5e0cd9e79b0c19b484708d8dd247389f2d0246cf76236e6b1869270e0fcdf58aa45b4252e110c0f65b8d480fa4cffe2eca10d11ebf65295cf87b

  • SSDEEP

    24576:8yE5waeuIs6C/GFLYDD2qvLD7HDZyHwkL+6Srp:rSJettEG+Wejj8Sr

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1