Extracted

• • Target

    65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e

  • Size

    943KB

  • MD5

    6adc6ada2339ac051903999bc36faf3b

  • SHA1

    d03e60cb7c43b8af22028b9acb3bf6ef9c69d3c1

  • SHA256

    65affc8699d9413e3016717cf224871127d4e8b346d42ae888abe5f0469e414e

  • SHA512

    c73faa5d52818fd0ffab0ff273b96e3745f22e3b90321ef099617b895b1187245f16d7bb820ea415b1fbe62d4dc34b2c3ffa7786bf7d69abcf8933c4b3d00187

  • SSDEEP

    12288:ZMrMy90mejTjWI3jJlZ6Ra6wKX+6FTiVvGe3TBErdyqDXOF5rpFSwxKqzAh2Jpvb:dyWjNMRa6wJUm5BdSyRrpFflNsItt

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2