Extracted

• • Target

    cf78d5a6c15c53e5752b1a353101659d6046a724f274b361076a2f50a408e407

  • Size

    892KB

  • MD5

    19a9e02e0f8d7c4d9bb0dd60d8c978e3

  • SHA1

    bd0c6b07cf21b3e662c25e0014a8683d208c1fb4

  • SHA256

    cf78d5a6c15c53e5752b1a353101659d6046a724f274b361076a2f50a408e407

  • SHA512

    6f0301751f03fb524754ab50f1537e585c4e6bffe6b962ee7e30c9f115a349074d78b068bf58759aacc2cdc8e56b28cd83004ee65c2fc9e78091a7e2daa0f928

  • SSDEEP

    24576:LyAGitOF5OBnUL2Mbo7OU5glvO5yggFm1Ea/ojINbzKKFGt:+AGitOyBnUL2/7duVCjP/ojibzKK

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1