Extracted

• • Target

    8ca41ea3c3e20c751b3cec6e9a3eec3e2ce7629a322f9f26919543f9328b0e37

  • Size

    893KB

  • MD5

    a28ee74b3ec1903fc937b58a7b57ba36

  • SHA1

    2675065fea3cc12a63beefcb1d43a0fc240e3203

  • SHA256

    8ca41ea3c3e20c751b3cec6e9a3eec3e2ce7629a322f9f26919543f9328b0e37

  • SHA512

    f51b122059deb78afea97f949716b5daec8a237e23950d9335125ddbedeeff19b72d1eecdcf8e239bf679ead3a6f7f69ed65bbb0d1a53202915be4d3393099b9

  • SSDEEP

    24576:yyGnJg7lrDwaabNIJD1ywHNLRJD8wwUYt:ZGylf1aGJD/1NVY

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1