Extracted

Extracted

• • Target

    cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d

  • Size

    929KB

  • MD5

    8c1cbbe3e2da4c16e2b7ff14afed2eab

  • SHA1

    bc5970573f300823ab8d541d12473e5b09726fc8

  • SHA256

    cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d

  • SHA512

    cfaaaf148e5132467a27106aee11811636c31e26d32f537463f5295230c40bbcb776b608f1d32433f3b5204a4ba86e4bd49ba172f7d9926f4809f13cbe681ad8

  • SSDEEP

    24576:2yBTSyLMaN8IiW/UcBQGF3UHbXmY0EkE7iRE:FkyAaN8IigUcL67mLET7

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2