Extracted

• • Target

    4924c0344f15212afda72b1177efaab11c010cc568b92d09ba5735e81ffbff5c

  • Size

    1.3MB

  • MD5

    3dabb4266fd89f7c51473310c3a6b41f

  • SHA1

    37f50b0b8b9d6829bf7853839209be865c61f53b

  • SHA256

    4924c0344f15212afda72b1177efaab11c010cc568b92d09ba5735e81ffbff5c

  • SHA512

    d4b81fefd2b373e214958c174107946502838807c738b330ee96babfae20afdce568cc9a8d6afcbbdb024f0275c5e3759f51a6d4920152ba9a7af50d4e1386e2

  • SSDEEP

    24576:pyXesjrCSifZQZk9qwKFjLebjD+zLZ0MIsjh7aYeD3NZNgjOXCtjl:cXRreOUq9jqul0MIsjhW3NgWK

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1