Extracted

• • Target

    2a71c069ced4a4f8e33edffc52ee4c40N.exe

  • Size

    593KB

  • MD5

    2a71c069ced4a4f8e33edffc52ee4c40

  • SHA1

    4d027de41adaf8e98178bd6001733f7d82c9753b

  • SHA256

    65446b14c97c3a91857a5abdc890a7aeba14cb2c164399b37e01ac5f8ecbb53e

  • SHA512

    c8bcfa3ad11692a8f20ba4a210f5ba9fbc82c47c250d93b1309ed70b6ab982387d33f3c44b4889d57f5c28c2b3a895cbc841cb9bc05c04582a66e8bdde4165d2

  • SSDEEP

    12288:SMrsy90E6N6sy1YZLArW96Kwbtt8LAuUNl26fh:yyptNY+6vwbttZuUNl9

  Score

  10^/10

  mysticredlinekukishdiscoveryinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1