Extracted

Extracted

• • Target

    4ea8a8a21cad8ae098aa5d504ae609023d9f506b724c4ebc87838d6c2641cd04

  • Size

    1.4MB

  • MD5

    cfb161e90f2abba876fc5a11a4b00af1

  • SHA1

    f74505080ead9fa5c6b6d7b38cbecd7a9f7fbbd5

  • SHA256

    4ea8a8a21cad8ae098aa5d504ae609023d9f506b724c4ebc87838d6c2641cd04

  • SHA512

    afdb6e707bd036c2a6eddbe63a1b372e999a488b8579f3862738dc86b3a0aedf4f0bd38a2087f702dc5162d500d87d43b900e34146a3fd49b88d3af49033704f

  • SSDEEP

    24576:HyD3wQe4d8BLeTIsLOpGfZDD5vIrzlCUoXBBySqpugO9C6:SMUye8YOG5hIrzwUymSqput9C

  Score

  10^/10

  mysticredlinesmokeloadertaigabackdoorinfostealerpersistencestealertrojan

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1