Extracted

• • Target

    82e3f6609a70db99ce5665b721eb287ee4d7d270661728e0d6cb4eeaea882bfa

  • Size

    886KB

  • MD5

    8ecaf353e7045fc511ae4dc69e7ed597

  • SHA1

    fad1515b8efb456fb1f19e3f6bd28c889d246cc7

  • SHA256

    82e3f6609a70db99ce5665b721eb287ee4d7d270661728e0d6cb4eeaea882bfa

  • SHA512

    24fd573513abcf4917ab5461fef3768aab95672906a91dcf7e107742d04473a707977735e6af3a3a1de8c53def32baac20d3e3f3f870f93cf4467deddcd4e1f5

  • SSDEEP

    12288:UMrHy90glCgRVirR9XZAbM1ckX9e/mIHkPCR3tPHVaZ0gjHYusq/H3i3DzJf4:LyFncfXZ+UDkltP1aZ0gLbHyDza

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1