Extracted

• • Target

    72a194ce09ab3c83ef3ca921476d23917984354feb35ee602f02d9aa2d55b33a

  • Size

    892KB

  • MD5

    cec9b75217ac69ead61a286c4ee1927c

  • SHA1

    e7db2ee95ddd6c9c9eff536558baa2959fa2f297

  • SHA256

    72a194ce09ab3c83ef3ca921476d23917984354feb35ee602f02d9aa2d55b33a

  • SHA512

    5f39a74bea174a4018b500cf35bff5a74ed45519809d929e53e879eba157bbdb019fb484e73107fd53ee41f46fa71c3ec3c758fbbe362683de4feda73b6836c2

  • SSDEEP

    24576:by4yfLhmffQhvvb7oFmyE73CvtUvPpMrFns6pkeyYd69S:O44FeQ9vbkFmpDCvt8PSrFs6pFyy6

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1