Extracted

• • Target

    168af7c166211cdc9b549fd748c7ad2e314b18b5df021eb3aeb0c2fdef09ab00

  • Size

    896KB

  • MD5

    b031663aedb8bd30e7e642bfb5596b0d

  • SHA1

    fd4deefb6a437e47c7023c126d8bef981eb31e17

  • SHA256

    168af7c166211cdc9b549fd748c7ad2e314b18b5df021eb3aeb0c2fdef09ab00

  • SHA512

    c93c67f05f0c6e307efb2dfa3205a7ac76a72d46b74c63dadfaf95d494888858776691c2ddc2ead18bab27378ed5ae5e3c0a0f6048e983629dd8aabbb3d1f245

  • SSDEEP

    12288:9Mr6y90i9GrZN7WAwG0kCHzT6yuhbE2XAljW39Z/oa3Ucqe9z8LBNOOMma0vLfVe:jyK2GM6BE41bkcqgz8LBN/DfpXUGWb

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1