Extracted

• • Target

    0a1e584362c5c329dcf83ec9453e7f2d553237d69d8c183bafaa2929bc8e4b99

  • Size

    517KB

  • MD5

    2bf4dd15fd808607503f8e2295a4dfb3

  • SHA1

    ee540aba9d5ad740e85f6e20feb2cf6c37081c04

  • SHA256

    0a1e584362c5c329dcf83ec9453e7f2d553237d69d8c183bafaa2929bc8e4b99

  • SHA512

    6ba761f676170ccf4f89706d30e3afe464d261861ce0d85811b40254a5baaa708deea9a92e6bcb2680923c8cbb462fa05e95de0edc674ba0b01f417a4614da39

  • SSDEEP

    12288:GMrWy90kj3M0SlLAzzIvPeT42BiNuA09NZkmuzOF+Q8U7:4yVj9zkuHiz09gmD+Q8U7

  Score

  10^/10

  mysticredlineluskainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Detects executables packed with ConfuserEx Mod

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1