Extracted

• • Target

    malicious.zip

  • Size

    1.8MB

  • MD5

    6e21499d32f36f93fa176f38fb4b9b77

  • SHA1

    63136b30330cf86527a87f986c5eb5dffaba66f6

  • SHA256

    4f39c7599a824ba6f9698eb2ccf780ee4aa30a427ea3b8acc4254916068e07d4

  • SHA512

    5d665ce32e9fedc302c0487fc49c5f808f47e6fae7628926498931e50d98d03ff3d0ee5fb8cf0fa7c0c3a2b54e2f18d19a376ad9284b06433b9154b9d09dbe0c

  • SSDEEP

    49152:R5BZHSCcUzdE+vpwuSXg3Hbr0ntqYHqcB:R57RniuSXQ7r0tqYKY

  Score

  10^/10

  mysticredlinesmokeloaderfrantbackdoordiscoveryevasioninfostealerpersistencestealertrojan

  • Detect Mystic stealer payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Mystic family

    mystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Smokeloader family

    smokeloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1