Extracted

• • Target

    168773a80b7139041f523acc4f3f8893af24bfc2834124b92f3ba9d29f535600

  • Size

    929KB

  • MD5

    8956e752d308694b1d1c076aa0f01382

  • SHA1

    c574c2f08e08eabff5d2596cfc1f15361c9159a5

  • SHA256

    168773a80b7139041f523acc4f3f8893af24bfc2834124b92f3ba9d29f535600

  • SHA512

    1b79a0d3147db43c398efdb10abe651268108f3921b46c2eaaf0419221e8c6c6750760d69b460bd03ff9c4d8c2e74a83179128bb244a472e5f6d613e340d25d8

  • SSDEEP

    12288:+Mr7y90OiXqgiZCQSU57qewBRPPTABw2LgqitgKkp3kGCe6j5aE4PRbWV71c2Up0:Jy/eqn4BU5YP8m2LgnuhKiPNWc/E

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2