Extracted

• • Target

    54f1280cbcc0fd2100e6d12d2347146ce3553bd2e15524aaeafcc000d14f7ad3

  • Size

    1.6MB

  • MD5

    3e4ec17d3ecded819ae05bffb4acb5da

  • SHA1

    de36df2f44f14ae0f63321ff1963a2743b79181c

  • SHA256

    54f1280cbcc0fd2100e6d12d2347146ce3553bd2e15524aaeafcc000d14f7ad3

  • SHA512

    62d3b31a18ba0cd777dcfb28b29c3e9367f0330bb2232cffb0fcfd1a0da89efb76cfaac08dd9aef157aca5d119a9af8c0b46ec682aac6587fb40818ee4dd05c7

  • SSDEEP

    24576:gycCQhI/+6rjfGYJCbImv0AgsjExiBITAMvprkimrr67yJ85dHeo60n5Hx2n3qHF:nwnzv0AfuiBYBJbzdH96W3EudNXMwSK

  Score

  10^/10

  mysticredlinegigantdiscoveryinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1