Extracted

• • Target

    60b345feed921142d86737e3c6897b0f.exe

  • Size

    896KB

  • MD5

    60b345feed921142d86737e3c6897b0f

  • SHA1

    34956700dd049b0d91cad261f0053aa14a2c95a0

  • SHA256

    4d201919a0ebca66c9444a66f9324fb870e4af25252f27aa405255cca0167379

  • SHA512

    456da362b0f0825b3219f4913d209a4fe931d643ebce0eb985205b6f1b3c1da93ab11a88f49da2433d55f925848dd8668f83a8e9eb1c9867fd73888f64355e16

  • SSDEEP

    12288:+MrHy90LW8MrTI+xEBRju2M4iFA1ejxeeuzxQikhOEufTJlnGYJjr6bycGDTFyQs:5yFI+xmju2gO4KQ9hfqzHgy0Qpyo8

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1