Extracted

Extracted

• • Target

    a14d4837f9d4ad75d46f5d74561672c36ff9aa6cbca32db33d795bcf7a79a70b

  • Size

    1.4MB

  • MD5

    c9c54717dd8e7a5dcc847df4cf081793

  • SHA1

    1dc6104b0a9f1e7c6807afe09edb861df26a2193

  • SHA256

    a14d4837f9d4ad75d46f5d74561672c36ff9aa6cbca32db33d795bcf7a79a70b

  • SHA512

    2df2eab35e3664ae3c0aaa619c5f16b8fba266a0c0f232357a78d93f4022b6bef6aa5147688147f48fecc80291f2a60ab7773b165b6f1d700ea46ca5fda5222a

  • SSDEEP

    24576:kyxxZefzya8e+SfTH/6kCLL2SqYGkiP0YmkQHRyWUh+Gfw1YcqLPkMlapa:zxx8+aaQbLiC1YGki6kSRyN+2yYcqz2

  Score

  10^/10

  mysticprivateloaderredlineriseprotaigaevasioninfostealerloaderpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Enumerates VirtualBox registry keys

    evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1