Extracted

• • Target

    0807a66b3d523ea0142a42065ed0c4112a65d780377faf9be6906a3d09009602

  • Size

    944KB

  • MD5

    aba6186eebbe34a70a1c1d81bec8bf2b

  • SHA1

    87f02328a6e76fbe52e60442485242ed349b446d

  • SHA256

    0807a66b3d523ea0142a42065ed0c4112a65d780377faf9be6906a3d09009602

  • SHA512

    f7d5893ea02015e32929ba86dccc9f29c034ebd6b57a6cf99019fd3e380c384e32d6aac8260ad2783511b3148a9cc26544b4b9790f7f4156c554ef9ebb1e4733

  • SSDEEP

    24576:8yAE0UIFNw7wefWYhOpWhM2E8Ua3uGVUhdvKf:rd0pLw7wQWoia3Q

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2