Extracted

• • Target

    ce1d911aacfe04d7402e5091360c970f3300b97598395857d7f995b69db0f113

  • Size

    1.2MB

  • MD5

    1966db4c9273aad741f19080a155f754

  • SHA1

    56eeedd20c29e388a102ec400f6136141604d52b

  • SHA256

    ce1d911aacfe04d7402e5091360c970f3300b97598395857d7f995b69db0f113

  • SHA512

    58d86462755bbb67a59682ef3380d9dcbca5a9de797e9d8148bde4d75cd4e4603eef4d2b27f1a7024bb3b0008a0e85f70ec0bb349ddbd4c39abcd5f89d114b08

  • SSDEEP

    24576:Typ/bj4s2aMUH1R8f7t6M9x+pD0ko6FdYz/+WkmQrz84o:m13lMUH1cLxe0U+amQP

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1