Extracted

• • Target

    4f09e5659794eaea5955bcb72eafe75510d97aa047565312f4c4d37826f3d93aN

  • Size

    678KB

  • MD5

    809e72b60c534a9e32aca15039d5c560

  • SHA1

    914934908c05809566f284dd977813d667cb4590

  • SHA256

    4f09e5659794eaea5955bcb72eafe75510d97aa047565312f4c4d37826f3d93a

  • SHA512

    e37d266520692ec449859ef3eb67519a5fbb8ecc5a7361b2ce375f2a7fa7600343296edb16076f8b8094fd188cfe9a031b821f849d40a4178789e830dc686885

  • SSDEEP

    12288:LMrQy909nEKRresal5ngE2BeVHs3lv0wOD1zruOR+jeVh2hOaBe9IU5Wh9YVl:HyUnEKR96xn2f3tx+1DIK72hbB+vr

  Score

  10^/10

  mysticredlinekinzadiscoveryinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Mystic family

    mystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1