Extracted

• • Target

    671f677114ca5a4015889185520ac4fd.exe

  • Size

    894KB

  • MD5

    671f677114ca5a4015889185520ac4fd

  • SHA1

    ee6c0402d18d324f9ff5e108d2feea23368c7308

  • SHA256

    371178f2c72748b41e33d1862f900e09d955f884f4b59857073c409e61b254ce

  • SHA512

    e05f8e8da54d8bcd94c87d7d23449b8410baa4a73fff8ecf1c9ad02108f5ce5b28bced96a4663ac69623097bd71400d4c504d341793edcbc08ed20d61f201f13

  • SSDEEP

    24576:Iy415FlI4VNE1BhBy5JPBPkA8ArVo8BljJ+7568vW:Pu5FlT8P8JPydC1B9J+7

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1