Extracted

• • Target
    ce1d911aacfe04d7402e5091360c970f3300b97598395857d7f995b69db0f113
  • Size 1.2MB
  • SHA256 ce1d911aacfe04d7402e5091360c970f3300b97598395857d7f995b69db0f113
  • MD5 1966db4c9273aad741f19080a155f754
  • SHA1 56eeedd20c29e388a102ec400f6136141604d52b
  • SHA512 58d86462755bbb67a59682ef3380d9dcbca5a9de797e9d8148bde4d75cd4e4603eef4d2b27f1a7024bb3b0008a0e85f70ec0bb349ddbd4c39abcd5f89d114b08
  • SSDEEP 24576:Typ/bj4s2aMUH1R8f7t6M9x+pD0ko6FdYz/+WkmQrz84o:m13lMUH1cLxe0U+amQP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1