Extracted

• • Target

    0a5034ebd807bcc7ce919cdc43b786b3ed42d24d32aaf161b51a421d1fcd02d8

  • Size

    894KB

  • MD5

    414e49550b93456297e51d9ce441fda1

  • SHA1

    600d503341ccfcf69053d58364b3c553d940e76d

  • SHA256

    0a5034ebd807bcc7ce919cdc43b786b3ed42d24d32aaf161b51a421d1fcd02d8

  • SHA512

    1a1e4b78f44f6683746e7510c2bd3ed3d57a4c2dd60fb1eb0471d8246205103c0649dc55577a73477c780721fa08fd9dfd3aa73d795fd6a63a75eadd52fb413e

  • SSDEEP

    12288:/Mrdy90MbqTiUihuGPxR91E70d7H5+vGqrS818TSffKM3wVu4b:ayK2UiMGPxR914i5+vGqh8Tiyg4b

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1