Extracted

• • Target

    7337b7025ab4e60b33704ba6b639e6384402a8f03f8d9dbc7f89b20f4ad8d63e

  • Size

    929KB

  • MD5

    8b2f4a124b762e73f27bc6cf7fbb7370

  • SHA1

    5d2026075e650799b51f83c80f465b18c9ef182c

  • SHA256

    7337b7025ab4e60b33704ba6b639e6384402a8f03f8d9dbc7f89b20f4ad8d63e

  • SHA512

    0a1102627a52d70042351ba9c05e8231e15b4d019e219c9f4341935add09aebd3d62071f529a2aa447b4cc467db3a76bdfad25097d335d65067e08b6d5c02e8b

  • SSDEEP

    24576:vyF1XTXNeC59fc6Ia1yJF/WWizEmhS6QOcMfdy7IhciZNYObWx/9:6jDYC59fcbDWlo6rfd7

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2