Extracted

• • Target

    a3f71cdea149e6361749de174f298bd2605c6a018c00e640760cea83903f2ad8

  • Size

    926KB

  • MD5

    62879e309c95ed89b9d0fb95661ea692

  • SHA1

    d7300955fff75dff26b45e52c79f9e6a374c7367

  • SHA256

    a3f71cdea149e6361749de174f298bd2605c6a018c00e640760cea83903f2ad8

  • SHA512

    7c45e3a28f7582ebe65f1e9dd3aa194d5f2c4e9df0cd08f7b93d66ce28a2377533cf3cd1f0c884e8571f5c47913dc4a9ed25d6366819f03af347c6e81e9eed5b

  • SSDEEP

    24576:5y9zzATehEAovEhVV41n1RfZ4VPMNUq3yVy/Jw:saTehEAcAn4B7fZ4ZiTMm

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2