Extracted

• • Target

    7d9837d308d96f96fc3b7fc68a7e4a933a1c4268a974e34629661dec50214832N

  • Size

    821KB

  • MD5

    639d8042d16de28c65e78469e505a4e0

  • SHA1

    8382e873cf83e53adc9808d492010052375d194a

  • SHA256

    7d9837d308d96f96fc3b7fc68a7e4a933a1c4268a974e34629661dec50214832

  • SHA512

    9e5c3b437202b17c0d9c7d1fdb303c5402d5dc95ffea514e0ab61c3368d9f08c32bcbea1ef23e35ed32a60f1a6b574a30a6b79d2f95cc5c338a252d823b6086a

  • SSDEEP

    12288:iMrFy90iQyaEisqVQ2/SmB8sMySNPrr28fxpIN/tyBmUUBfAChHsvVp4DMJsW:PyxuEC/SecuEIuBzyfhkHJJsW

  Score

  10^/10

  mysticredlinegigantdiscoveryinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Mystic family

    mystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1