Extracted

• • Target

    e2502554068fee866c0f473c76c00825cf533aabfafa05a66a55f561c4aa5282

  • Size

    929KB

  • MD5

    50d38c4b31e45387a340932593736f15

  • SHA1

    0b62123936e2c3dd7f2070da7c901d62f4c759be

  • SHA256

    e2502554068fee866c0f473c76c00825cf533aabfafa05a66a55f561c4aa5282

  • SHA512

    363a6a280e08c3c29aa6732f46ea103a6ea3db32faaff8080b52eb2e7f8b532e26ca45bd6b4d13087e250fd92e2543dcc48df33c98acb608409b7d9007f2c5a0

  • SSDEEP

    24576:Oysl8HAB2j6KL+xjRXPk9/HmuB7Mu77W5+kIawC:d4+QKwNXaHmuBI13Ia

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2