Extracted

• • Target

    7933fef612cfed24528ffac4aad5a6e220fd5b4ace233682c5f634c88264b8b2N

  • Size

    879KB

  • MD5

    219de7799d0ae3a227896e76a31b1a50

  • SHA1

    f52122d9e3d9515c91306c7e4f5c0ab862e5704e

  • SHA256

    7933fef612cfed24528ffac4aad5a6e220fd5b4ace233682c5f634c88264b8b2

  • SHA512

    f9b6f9bed1644946a5138dd964ff69f86ebf4c252e143dcdb918a620ece9765b82f03ef6fef2f2eb621cc8751577f80bd6e96f6d800f21ff0c7f7a4749975e8d

  • SSDEEP

    24576:fy1UUaE7Ns0fhyLYzVA2HR8RKV4dtHEnYp:q1UXcc4SSR8RKV4dSn

  Score

  10^/10

  mysticredlinelutyrdiscoveryinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Mystic family

    mystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1