Overview

overview

10

Static

static

3

16b785fdba...08.exe

windows10-2004-x64

10

17bfe16ecf...a7.exe

windows10-2004-x64

10

30deda44ad...a8.exe

windows10-2004-x64

10

3e348a855b...4e.exe

windows10-2004-x64

10

458df588f5...8e.exe

windows10-2004-x64

10

481a0f4fa4...b6.exe

windows10-2004-x64

10

54ca1e2099...d4.exe

windows10-2004-x64

10

5645ed9dff...fa.exe

windows10-2004-x64

10

5d8e30863d...60.exe

windows10-2004-x64

7

74646b4cce...46.exe

windows10-2004-x64

10

86e6dff72e...d8.exe

windows10-2004-x64

10

8fe46c7fa8...3b.exe

windows10-2004-x64

10

a261c92b0b...5a.exe

windows10-2004-x64

10

a67b0f00c8...14.exe

windows10-2004-x64

10

acb13f0321...3c.exe

windows10-2004-x64

10

b59f946473...f9.exe

windows10-2004-x64

10

c15c0b27fc...af.exe

windows10-2004-x64

10

dbb1ff59d8...b8.exe

windows10-2004-x64

10

e45cad29f3...cf.exe

windows10-2004-x64

10

fd708e30f7...e2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    r.zip

  • Size

    17.0MB

  • Sample

    240523-x1mpmadb5s

  • MD5

    c3335766ffca337b13fb7f9c720ffd15

  • SHA1

    13f9a614aa908ba95975f56dc2a7c7b08ff054f0

  • SHA256

    3c91163ea40ad7e35bac48ded16235cfe9003c914f570e27b4e2d7b3c9c46c05

  • SHA512

    d2307c7b2bf7987c985cf3bded531baca4ff66b686f2fabba0ba8e8dac47ea41a9273a958b09d42e7f6e619941b5ee77c5f1c9ee6ed790951ff4e104f4b64c80

  • SSDEEP

    393216:BdupBu0XYPuj0Pb9Aj6VGFuRvplDn7OqC1CftkL0C:rf0hZ6VzVplDKqC1UQ

Score
10/10
amadeyhealermysticredlinesmokeloader04d170daf753frantgigantkukishluskalutyrmonerbackdoordropperevasioninfostealerpersistencestealertrojan

Malware Config

Extracted

Family

redline

Botnet

lutyr

C2

77.91.124.55:19071

Extracted

Family

mystic

C2

http://5.42.92.211/

Extracted

Family

redline

Botnet

kukish

C2

77.91.124.55:19071

Extracted

Family

redline

Botnet

moner

C2

77.91.124.82:19071

Attributes
  • auth_value

    a94cd9e01643e1945b296c28a2f28707

Extracted

Family

redline

Botnet

frant

C2

77.91.124.55:19071

Extracted

Family

amadey

Version

3.89

Botnet

04d170

C2

http://77.91.124.1

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

  • url_paths

    /theme/index.php

rc4.plain

Extracted

Family

amadey

Version

3.89

Botnet

daf753

C2

http://77.91.68.78

Attributes
  • install_dir

    cb378487cf

  • install_file

    legota.exe

  • strings_key

    f3785cbeef2013b6724eed349fd316ba

  • url_paths

    /help/index.php

rc4.plain

Extracted

Family

redline

Botnet

gigant

C2

77.91.124.55:19071

Extracted

Family

redline

Botnet

luska

C2

77.91.124.55:19071

Attributes
  • auth_value

    a6797888f51a88afbfd8854a79ac9357

Targets

    • Target

      16b785fdba23a1e8ce123eff83acdb78721163b0ff8cab22979a4b4fb39ec108

    • Size

      640KB

    • MD5

      7cfa0d411448e107aeba15ed220bde20

    • SHA1

      a9486fc6de8b4ab9135eeb034f261b4f426f34ee

    • SHA256

      16b785fdba23a1e8ce123eff83acdb78721163b0ff8cab22979a4b4fb39ec108

    • SHA512

      368c2bf8f37608c6f6a8a5e45626f39ba2cf2e44fd0bdd5f8d5f60eafbf3e62aa6500fb8505f7f262c5a1fa0581956f637bd73f3611cc78fe3719aa9e753ee01

    • SSDEEP

      12288:MMr5y90o4ugxm9XP9mg39ZnzdjOgXBYHJ2CKJQGEfUbIjBsLpQvb:Nykm3t1zFreJ2nJQGYPKLS

    Score
    10/10
    mysticredlinelutyrinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

    • Target

      17bfe16ecf74ce58c323a518937f2920942fbcfac377f13e045e81269c09dba7

    • Size

      858KB

    • MD5

      870ff345d2551de9b31e3fbae0380510

    • SHA1

      34b84a48a097243a24b31dfc0db5f75517f06230

    • SHA256

      17bfe16ecf74ce58c323a518937f2920942fbcfac377f13e045e81269c09dba7

    • SHA512

      ee845c6271464a2728895682d2d30a7d24a20fd47f6f2c7cc55e50cf7438bd860d290f6cbec5f42c56de072feacb7bfb6b61f3a88b447d8fe7d4a4364d44a318

    • SSDEEP

      12288:VMrWy90CmpizQ+cKZdEtVdzVfkUe9QGF13NyzmMoP7ruUli9maGb+irj6:nyyiOKZ2ndzVTYF4c7ruUllaEy

    Score
    10/10
    mysticredlinekukishinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral2

    • Target

      30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8

    • Size

      879KB

    • MD5

      bb845a15dee0ce72c5ec078d787e575e

    • SHA1

      34dac2c18762806063ac9a6da35f8c01c3d2dbd2

    • SHA256

      30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8

    • SHA512

      1b5ea031e494e67d5dbb811c5c0eba5c2994088a7837058a3e3017adb72ffdb8b98d947900fd5abd3466e22304d08d7bb32d55e1c2284f35c188eedd0c4e2474

    • SSDEEP

      24576:RytpC1GzopxzgjCQIWyraHbJPKd6NIT3R5Pi+OJp:EtpC1GU2CQIhra1PKd6NIHXOJ

    Score
    10/10
    mysticredlinelutyrinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral3

    • Target

      3e348a855b33640bb6aa790859bfa7dbd1b740b53c1de343d38127d859c8f54e

    • Size

      598KB

    • MD5

      ef05c4af3fa8c48fc1a3c918a044338a

    • SHA1

      3b4169fb61e0bdfb2282c39ba798e74ff906bb44

    • SHA256

      3e348a855b33640bb6aa790859bfa7dbd1b740b53c1de343d38127d859c8f54e

    • SHA512

      5263ffe286c38403467462f3d2a2ce77b0a7ad70a7bd01c77b859dbe47e069bca8b64609a08bfa7917e834644714b86b46a5ee43e4daaee254102169bac43cd5

    • SSDEEP

      12288:MMrdy90Gun5B6oTeRNKHPWbOk9fYWpGxkkY5kkfn3mfyp9TIbIpEfEdDs0:ByeB6oTebsRcfYyGxkX3jpbemg0

    Score
    10/10
    mysticevasionpersistencestealertrojan

    • Detect Mystic stealer payload

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral4

    • Target

      458df588f5966c10e2094b70930a00d3b16a8c7a53455d78817db7b98db8e48e

    • Size

      1.2MB

    • MD5

      749cc27ede9844db268292f4bfb11810

    • SHA1

      c5ea969f966654b089c5ea4ff849dca2d9a2d0b3

    • SHA256

      458df588f5966c10e2094b70930a00d3b16a8c7a53455d78817db7b98db8e48e

    • SHA512

      57613793dece26dbfc7466c96ab5dd120d5a57e1d669ffa0d743cab0b14b3f10316bca821ea327fdffef86cbc3224fd0f10900475ae98ef326f863483f600915

    • SSDEEP

      24576:xyFAyEwceNyOtnb6W4rS+we8iviqMSXOwVD6OiaWK5:kQwceN5CrS+1Z6ETVDjirK

    Score
    10/10
    mysticredlinelutyrinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral5

    • Target

      481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6

    • Size

      725KB

    • MD5

      92fa0c8a34a4b40892e461df85d70580

    • SHA1

      f7141dd42442351ea2c67a386f53cb32e909072a

    • SHA256

      481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6

    • SHA512

      b717ff2d7d9e397604fd0d18dfb2d8e0aedd715d70f63cac0dd0559eaeabb393dd67a414db83cfb8a296a3cab90c46b7a9fea2d9c349d09cc00076fc3334526f

    • SSDEEP

      12288:4Mrny90/ONoGBpP8dN21TMXvsRxswsfMwyalVzmDWQcPnu427cWQX+pWd8k:Py0UpfTMXvsR9sfTrlVzrJPulQWJUd8k

    Score
    10/10
    mysticsmokeloaderbackdoorevasionpersistencestealertrojan

    • Detect Mystic stealer payload

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral6

    • Target

      54ca1e2099a7fa3784bdf97aab3d613e7f208386c64b96702c21a1faa6cf17d4

    • Size

      362KB

    • MD5

      c2941ef0e1a079c6c8689d4966978fe2

    • SHA1

      ef1caf837907fad59ab93f69ab37a5fb8e7a6437

    • SHA256

      54ca1e2099a7fa3784bdf97aab3d613e7f208386c64b96702c21a1faa6cf17d4

    • SHA512

      83d345793e63c4fd3bfb7af001af16adf18dc7ae05ce0ba6574a738350dedc276f659fe70648cf296426c493a7a8e25e9285250516c7fa172b5ed025f599bb02

    • SSDEEP

      6144:KTy+bnr+up0yN90QEoCTn5B6oTBcatf0efqG5l6qMzsMAD71:ZMr6y90mun5B6oT8OMzsp1

    Score
    10/10
    mysticevasionpersistencestealertrojan

    • Detect Mystic stealer payload

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence
    behavioral7

    • Target

      5645ed9dff35fefe6b0bc81a6383947c80bd191f23dd3516f6483675123a0efa

    • Size

      929KB

    • MD5

      3ccf8d264d5121a41b62ae6db8110bf0

    • SHA1

      a944f8f011db9917c142c44d8621f57737925f38

    • SHA256

      5645ed9dff35fefe6b0bc81a6383947c80bd191f23dd3516f6483675123a0efa

    • SHA512

      275a371f9ca64141e6ffa2b8cb3cebb4a7efad64a33fa92da372e9dc08688ea0209146ad649f15501b026951a3d54d0b343d0f738670d0f75121284bdc1cd5c2

    • SSDEEP

      24576:4ys9bdFlXrQiUpE+kZML+2JSfl4xDE5jzC:/s9pFl7wBkG+9l4xDE

    Score
    10/10
    mysticredlineluskainfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral8

    • Target

      5d8e30863d6679d9b977e23a385bd4ab7c86293390507196e2c2a60350006a60

    • Size

      884KB

    • MD5

      8747aac71d50b90e3d130826a4ac1325

    • SHA1

      37843108fccb569bc9e09e02f74e8f2c239f7a97

    • SHA256

      5d8e30863d6679d9b977e23a385bd4ab7c86293390507196e2c2a60350006a60

    • SHA512

      a2ac56f6c745bdd65f1a4331828d3b6299f5d1c579d196a485825efdbf9a59601b8f2f73afb881db17f1897d5d95ae677839e67ea52fbe061897ffb286102db0

    • SSDEEP

      24576:Nykf9GM0FvYyBo/d++og75riw6DrtBxr:okVGRFvVBoV8gNGV3tB

    Score
    7/10
    persistence

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral9

    • Target

      74646b4cceb0bb3d3459ebc184168de79df4b60017876506f0f32e29b2ca9c46

    • Size

      1.5MB

    • MD5

      14c31f1cc2b909e3774579f25397c3be

    • SHA1

      9a89d41568afd0dc2a0ef490a42f6b564b924967

    • SHA256

      74646b4cceb0bb3d3459ebc184168de79df4b60017876506f0f32e29b2ca9c46

    • SHA512

      65c06155cf5385513e0879fd17b108d3884509b8b5edbb19df81d282df060e2e9acd3f13250b9c77edd06525719eccb1921cfd891b772ab591f1a977b22960dc

    • SSDEEP

      49152:h6gG5sijMECRAxmC8+gR4sFkYyXDZyVoTj:8gG5siolSQ+MXJUFJTj

    Score
    10/10
    mysticredlinekukishinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral10

    • Target

      86e6dff72e02aa5fc6a9340e3e1c0299c7d0ea1f0df3072b430e8033f71d29d8

    • Size

      472KB

    • MD5

      3cf105fff4aafab39052090fceff04d2

    • SHA1

      0286b25daf85dba275473f853f01c253dc5e6544

    • SHA256

      86e6dff72e02aa5fc6a9340e3e1c0299c7d0ea1f0df3072b430e8033f71d29d8

    • SHA512

      647c7efaef29acecf9a2e4c23873d676ad7e0d9cf35f9ce14af55667abc47f8894433c88636f75f2f8a62d3a1230ed952249f03793da4868b274413400fe1d65

    • SSDEEP

      12288:fMrmy90Hg+V6Pxnjy7ZINj15oL+N3Of2T:9ykd8B27eJM+NP

    Score
    10/10
    healerredlinemonerdropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral11

    • Target

      8fe46c7fa8f9aa4bf64dbc0fa9a1035875d7c94d139418284754473cc93dbe3b

    • Size

      1.2MB

    • MD5

      bee9d99ecef94f358964129388df01b0

    • SHA1

      828bcb3d3ed8de9b20d11206b81c837781695348

    • SHA256

      8fe46c7fa8f9aa4bf64dbc0fa9a1035875d7c94d139418284754473cc93dbe3b

    • SHA512

      d437f45bc4606f0b1ef8146fb59b69dfe5e0d2bc234b1ba15761e533fbb2e8d5b62c6e865994ad338e69f81716b9ceab4d6a9c8c0d71f454514e607642727e55

    • SSDEEP

      24576:VyGLW/wF2kZsHM8n7mQ4B6kAyQgNROuaNpszalvbF/Tm46Kp0Jkpd:wGa/CxqHJV4B6kAyQYHaNezqp/S46Km

    Score
    10/10
    amadeymysticredline04d170daf753frantevasioninfostealerpersistencestealertrojan

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Detect Mystic stealer payload

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral12

    • Target

      a261c92b0b446427af23fff63de38b1bb4489b888aac5ae088afbe7c6f827c5a

    • Size

      1.2MB

    • MD5

      ea5a087c245b19dca3060424ceeb20cb

    • SHA1

      acd89091e8e6a88a660f8148e18014909e01cbdd

    • SHA256

      a261c92b0b446427af23fff63de38b1bb4489b888aac5ae088afbe7c6f827c5a

    • SHA512

      43684dea22127c5a3954077fb562eb7fc862302b8e23b8d0c4385cdaf4b2870589a62e0d53435a38d0a3e8f95c7540d58e972559581cfd3837e9fc588e3439c6

    • SSDEEP

      24576:4yaKZsgacS0JNKedv2onMdoygB6B0muVQMa4LtlSNiVupM:/hsgacS03KEuoYoHhmu/a4xlS

    Score
    10/10
    mysticredlinekukishinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral13

    • Target

      a67b0f00c87205b2917cabeb880266cf00239c7b65d393223cafb9c141ff9314

    • Size

      1.6MB

    • MD5

      0f72a83a2d7b043a87baea811b6049db

    • SHA1

      49b8a176baedfa245d73c2a5368fb064d4dd09ab

    • SHA256

      a67b0f00c87205b2917cabeb880266cf00239c7b65d393223cafb9c141ff9314

    • SHA512

      3b971430d58ee125a035c969ee51e8274e4bd3c75a84da4e1ee2b208fe2372612db17878f18f73159cb6e412944008f00775485fa9a3535d510cbf74f9a070e3

    • SSDEEP

      24576:lyRDNs9NfmhHyRI63Tw61eXZSAYPlXFN6aSStK22nOAAKDPq1PZvZ7mFT5q4WjI:AAOlmIc/1wVG94AKJOArPUFc5Sj

    Score
    10/10
    mysticredlinegigantinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral14

    • Target

      acb13f0321ac71908364f97ff8978ac657f9e51a88a66ecd616be305b7941f3c

    • Size

      472KB

    • MD5

      73b24c5fbed62fe55c0b676d934a569c

    • SHA1

      dd67571559e5c8d6ac7bcbfd4023fc1060bad423

    • SHA256

      acb13f0321ac71908364f97ff8978ac657f9e51a88a66ecd616be305b7941f3c

    • SHA512

      fd9a760ead6233bfe8664a9c9781291c92ded59968756bcddca6c03477dd09acbd4b76866231ad916e14fd76b74fd0475c7fb3f5857b64e3c606ae1a693384e6

    • SSDEEP

      6144:K8y+bnr+3p0yN90QEvBjtZC+gmgO/qrD+UlnoH9aygS9NNbEilKrzED6gnWt8q:4Mrny90Xbx1/mDplsaibE7XVgnWH

    Score
    10/10
    healerredlinemonerdropperevasioninfostealerpersistencetrojan

    • Detects Healer an antivirus disabler dropper

    • Healer

      Healer an antivirus disabler dropper.

      dropperhealer

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral15

    • Target

      b59f946473d9797f3770e16ecd568aad1d0befdcf7a5c87e8f0d862bb8bacbf9

    • Size

      1.2MB

    • MD5

      6db2cc78302010ff4fc77c99f1480ce1

    • SHA1

      b02cd8fccb6aa8730c4303f85a52271021328b47

    • SHA256

      b59f946473d9797f3770e16ecd568aad1d0befdcf7a5c87e8f0d862bb8bacbf9

    • SHA512

      1a932bbfc164b5d8832e347f5ed30dd796a13afde5a0d346602ffdbbfa471c3855f67b56e17719d39321f867b351748f57caf7b3653b948dbb06439c7aa7c7de

    • SSDEEP

      24576:HybXzDvizdy5674iZqCSPHEmJ2HVVKwUbSUfkrcgC9:SbXizw5674sqVPHEmk1ch+UfkrcD

    Score
    10/10
    mysticredlinegigantinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral16

    • Target

      c15c0b27fca8b17175aa535d5bc1b804707b8bbce008e7a9e1fc93a2011ad5af

    • Size

      1.1MB

    • MD5

      0d1dd7a94e962d7b64553270a85c57a8

    • SHA1

      6b9abace5d34f86ee5d25270de8e5eea80ef7d77

    • SHA256

      c15c0b27fca8b17175aa535d5bc1b804707b8bbce008e7a9e1fc93a2011ad5af

    • SHA512

      54ad8d11b34e5233017546434ffcf5af61a042e487191126ed686693d72b6404e46a975d48e539f89243bca88055f652d2e6a000b5ee2533adbae1e5be30db23

    • SSDEEP

      24576:yyCgoasgooeYfdvkUaLV9YCXMC7RgY51pZZeY/F33VCr2:Zhe0vk3jYC7RV51pTp34r

    Score
    10/10
    mysticredlinelutyrinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral17

    • Target

      dbb1ff59d840e7c26ff269e10bbf5db72a563c700290b01fb63fd7d24ef302b8

    • Size

      590KB

    • MD5

      e7d79324c286301169d5968e9ef79625

    • SHA1

      84831fde7b54a23b71c60bf6ce158fe1d95e85ec

    • SHA256

      dbb1ff59d840e7c26ff269e10bbf5db72a563c700290b01fb63fd7d24ef302b8

    • SHA512

      6e2ce2657227127e5476f735de465156c087d087847f4417f3af1aaa14a0b8d7ade1b61f5f8559c42bedc0fdb4beee4a839e712ff86d1726d7b0bd6b3a16cb85

    • SSDEEP

      12288:PMrty90JdraPKejQkiikLIWIDmG2s3TamlIn:iyYraP/YIWuN2Yauq

    Score
    10/10
    mysticredlinegigantinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral18

    • Target

      e45cad29f3234c6392c5f6e84eb764dce17d47da6e46a61cd2f50f56ea080fcf

    • Size

      1.2MB

    • MD5

      8a5131fa4cb385e65b818b6189fb1662

    • SHA1

      eebf2ac535f51d7d16219ad1bc4fdf92f2552271

    • SHA256

      e45cad29f3234c6392c5f6e84eb764dce17d47da6e46a61cd2f50f56ea080fcf

    • SHA512

      884f4100578b35e61f5fdab2b90e374a00859764fb707778f124c7fd170d15081a33249dd5863a54b8740feaea817bdae31f0c9103e48425c79b791e7fb100e7

    • SSDEEP

      24576:ayjC2EmuBGN1X+5Xr2CwfnI36qA3CzkQERXVC/M:h7sGNlWKqAtQiV

    Score
    10/10
    mysticredlinegigantinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral19

    • Target

      fd708e30f7d26474cbb1cd6b2d77db28ffd7536090b6c02874b0aa4018c1b2e2

    • Size

      326KB

    • MD5

      127e2336ebe16deb60ca283437db91f9

    • SHA1

      3a3900abcc0162dfa098900f4efb1f111527ee92

    • SHA256

      fd708e30f7d26474cbb1cd6b2d77db28ffd7536090b6c02874b0aa4018c1b2e2

    • SHA512

      f75f8de57a1d5d04174661bf9331afe3bb34a5c245ec3b9bca323bf7076502cb918155a38e7481e31581d85e10a79ff7ffcb30955b33d8884ea4bf42d0d61b4b

    • SSDEEP

      6144:KMy+bnr+Pp0yN90QECsX6VOwPBIAy+hy8vlvZgRkajW1Rqv6KR:8MrLy90ws+OnA4q2i1Y/R

    Score
    10/10
    mysticredlinelutyrinfostealerpersistencestealer

    • Detect Mystic stealer payload

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral20

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

20
T1547

Registry Run Keys / Startup Folder

20
T1547.001

Create or Modify System Process

6
T1543

Windows Service

6
T1543.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

20
T1547

Registry Run Keys / Startup Folder

20
T1547.001

Create or Modify System Process

6
T1543

Windows Service

6
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

30
T1112

Impair Defenses

10
T1562

Disable or Modify Tools

10
T1562.001

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

Score
3/10

behavioral1

mysticredlinelutyrinfostealerpersistencestealer
Score
10/10

behavioral2

mysticredlinekukishinfostealerpersistencestealer
Score
10/10

behavioral3

mysticredlinelutyrinfostealerpersistencestealer
Score
10/10

behavioral4

mysticevasionpersistencestealertrojan
Score
10/10

behavioral5

mysticredlinelutyrinfostealerpersistencestealer
Score
10/10

behavioral6

mysticsmokeloaderbackdoorevasionpersistencestealertrojan
Score
10/10

behavioral7

mysticevasionpersistencestealertrojan
Score
10/10

behavioral8

mysticredlineluskainfostealerpersistencestealer
Score
10/10

behavioral9

persistence
Score
7/10

behavioral10

mysticredlinekukishinfostealerpersistencestealer
Score
10/10

behavioral11

healerredlinemonerdropperevasioninfostealerpersistencetrojan
Score
10/10

behavioral12

amadeymysticredline04d170daf753frantevasioninfostealerpersistencestealertrojan
Score
10/10

behavioral13

mysticredlinekukishinfostealerpersistencestealer
Score
10/10

behavioral14

mysticredlinegigantinfostealerpersistencestealer
Score
10/10

behavioral15

healerredlinemonerdropperevasioninfostealerpersistencetrojan
Score
10/10

behavioral16

mysticredlinegigantinfostealerpersistencestealer
Score
10/10

behavioral17

mysticredlinelutyrinfostealerpersistencestealer
Score
10/10

behavioral18

mysticredlinegigantinfostealerpersistencestealer
Score
10/10

behavioral19

mysticredlinegigantinfostealerpersistencestealer
Score
10/10

behavioral20

mysticredlinelutyrinfostealerpersistencestealer
Score
10/10