Extracted

• • Target

    6a73599227e89d1b5d677a38bb8a55bf83444df22bd7231474c08a09058ec5d4

  • Size

    888KB

  • MD5

    c9a81773fe199836f9319be0af18e3ff

  • SHA1

    5facafab3a75b840ba5fa7ed5bc1f3f1088fed06

  • SHA256

    6a73599227e89d1b5d677a38bb8a55bf83444df22bd7231474c08a09058ec5d4

  • SHA512

    4884d21ab3d4cf133c7c5eac75877aac925f28347b7ea621608f77d1b87e58ea9cf54f52b5260c526fca7e0e5f55d028e31ba06aca46c85de21403bc42eeed7b

  • SSDEEP

    12288:2Mrxy90LQSoUmANoeQAgay13MYj7Mwy3ZRR82CPgDAQ3AMa9bco+/q9i5wokQ:XycpGrAwtMWMLKsAuAMmbI

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1