Extracted

• • Target

    03db981f23f561a46d67fcfbd6809620.bin

  • Size

    511KB

  • MD5

    03db981f23f561a46d67fcfbd6809620

  • SHA1

    75d605263d8c15aa0c0b2a2c06ce8059a9b2dc88

  • SHA256

    8d94ba95d8c9e0a0bc87dd60e08f483b53dc533e1ce17d070e962dbc67f8bfa8

  • SHA512

    458873e2b5deb3b157cb19faa2f84bc5b67552c9a14a80814d8cca3c0da85083beed2a364a8a82dcefbb72d054f3b39d9bab3c39bdf2c6cc876492283f6fed8c

  • SSDEEP

    12288:zMr3y90IWgreWGl11wd2aY8TUs2Lu0+4+wSRIFQ7OE:YyhFYl1NaYSz2LubUSa0OE

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1