Extracted

• • Target

    14d695c1ec9a73ee2293603902be95508f6378f78737a51ce70901b602a1c85d

  • Size

    929KB

  • MD5

    299cd7a2e02c1750355def68009a316e

  • SHA1

    1940e007e036b2491e3167792dd13adb74dd231c

  • SHA256

    14d695c1ec9a73ee2293603902be95508f6378f78737a51ce70901b602a1c85d

  • SHA512

    0182a16b0990007d380e7a6d02390d27c094e4801f5607053597ed8f6c8afab9aa95373e041c47b7d22d588d0528d42e62ed75922bd3f524ae72938fc7412e04

  • SSDEEP

    24576:pyN6kW2AV6b/11GMCW29D6SKE/yWah3n4:cXWBO/vCWCeRJ

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2