Extracted

Extracted

• • Target

    f4555b54180c53e34ad814d42e0a845aa07e98bf0bd305194be7e832c63657d8

  • Size

    1.2MB

  • MD5

    07955226491bc30f939c7d1da1dbe64e

  • SHA1

    03881d43e06e1b02e5d0058b195203a1391852f4

  • SHA256

    f4555b54180c53e34ad814d42e0a845aa07e98bf0bd305194be7e832c63657d8

  • SHA512

    416ed817511c5ef2246b5e9da127a1c3a617673e926c88ea463172bfac186bb2e6ea736528ae0adc093b000e76b98b75ce783dbda0f3ff4ae8155f7a4e1d67d6

  • SSDEEP

    24576:ryyzUvBsZjf1NDCZroGqez2RDOS7J4Nx63+DuWFjURrZO7/7iiipdRS2NK5cm:e4rO4DJ7y63+PFIE/7mRSkK5

  Score

  10^/10

  mysticredlinesmokeloadergromebackdoorevasioninfostealerpersistencestealertrojan

  • Detect Mystic stealer payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

  • Detects executables packed with ConfuserEx Mod

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1