Extracted

• • Target

    ad48a3ac0e0b3103ca7e03dabd593345cce54d6e87488951d963179bb121de69

  • Size

    943KB

  • MD5

    258d72718e6928bd8e4260be30c178b7

  • SHA1

    c160182e8522667e749437f0589fbb9a4d4c74b7

  • SHA256

    ad48a3ac0e0b3103ca7e03dabd593345cce54d6e87488951d963179bb121de69

  • SHA512

    dadc143b88ed59fc28e1798aca89bc6a1ce275616d27fa032f94858d04c7ff024f67fa33d502c31e35af5486791d37250cb1a42626634afd281d4578e7de591f

  • SSDEEP

    24576:HysjB5xdr0uzNXmeJlc0q3eGk8CvgMSxO1+ahkNR:SC9G6st3eGk8Cvg7xO1+5

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2