Extracted

• • Target
    jaffacakes118_99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e.bin
  • Size 1.5MB
  • SHA256 99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e
  • MD5 d5b1f4584f629cdd85dfa6873d1c1e4f
  • SHA1 e4dcec5fa7bd2c6181a47d99acfa27c43033ba08
  • SHA512 0e02d1af6ce4aebe53093f3ec62ac813e4225a3667293e150c48bbadf72bc816ecc17bf0914337a0e3d4873f3f0a953a6a43ba5f7942549b37dc2aca0a353455
  • SSDEEP 24576:cy2iUHbLxfQMyCDCyUpwjoDMlFxqgFTvjSOZoN8qsCanWKDUo3+NdirX:LqxflapwjoonxntugoN8LlDUo8a
  • TLSH
    T1F3752306ABF96113FE7243718DB216971A35B9E428B8475726252ADB8D723C4F4303EF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  kukishdiscoverymysticredlineinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Family: Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Suspicious use of SetThreadContext

  behavioral1