Extracted

• • Target

    cba9f2e5cea06fc8287a3c7987fbe703d1e59c3089a3241a7dd673cdc3e076c3

  • Size

    892KB

  • MD5

    5d3131a868e493ceabb4647f5c9587bf

  • SHA1

    bbe56c732ce5cb1a09b79ca2e87163e4347e6be7

  • SHA256

    cba9f2e5cea06fc8287a3c7987fbe703d1e59c3089a3241a7dd673cdc3e076c3

  • SHA512

    f55d90afe75bec7f9bffa3cc26a7b78cc3f0085660f0953766e7cfaa84b63444a60f4782a546b8d8cbf1e4737e2802673fbf10bbe40cdf03b3d991fa77b9fe5b

  • SSDEEP

    24576:/yT/h8U1y/5b9AIbjznhXGZNyKxMhJr/4BGx:KTGU0/5ScozNsr/wG

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1