Extracted

• • Target

    961de4f4399a2e038f0ed6ed2cb2b38088bb394d4f025ec1d8ad90abb3216dbe

  • Size

    1.3MB

  • MD5

    0155c9ac5b9f4e72f0d20272ba8dbffe

  • SHA1

    c5db51764bbd8bb7e78307be2db1dd1c1942a6a4

  • SHA256

    961de4f4399a2e038f0ed6ed2cb2b38088bb394d4f025ec1d8ad90abb3216dbe

  • SHA512

    0e0b1987e95c7e6f417c8a2becb6a2bbdf12ebdb9480bdd5c87f838a4481d7db74e5fb373468e1b3b4de54a180f8a9cc04b3143e5eb945b335c3a0ff99005823

  • SSDEEP

    24576:VyHpcCjEEFkaenIszCMGWSKDvVoGhZ+auigaRkuWCYuo4AnDsc:wJcaEEHeI4hGc5ZpuihRkuv1u

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1