Extracted

Extracted

• • Target

    04140a07f858242aea2e5060fd52668d03619185d20f6c8b2c6debfe4a5f7b6f.exe

  • Size

    931KB

  • MD5

    d534bccd65f4d7cb7e7a00809fec8732

  • SHA1

    bd88bd428b8f9f5fb6ecb7e76b8323b94faa745d

  • SHA256

    04140a07f858242aea2e5060fd52668d03619185d20f6c8b2c6debfe4a5f7b6f

  • SHA512

    317581f76534d28b40095f49beb6a8fa42734da6cf939ecfd4363f24d94da782a08bcd64869adae11dec46003a5c3b46e23dc1c1c6708e621f250f13aa7c7e52

  • SSDEEP

    24576:ryvJJkCTQHmXNqP2T1YrBicnyBaG6+IyM1fAIv7Eo:eYmdqP2irBicX+IL1ftv

  Score

  10^/10

  mysticredlinesmokeloaderbrehabackdoorevasioninfostealerpersistencestealertrojan

  • Detect Mystic stealer payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1