Extracted

• • Target

    af23634579263656b8f66096ba9bd23ce4b5de406a1f739452a2869c7ed0488a

  • Size

    928KB

  • MD5

    db467347604242da38cbacaf023296ff

  • SHA1

    16f2ceb2d81dd49366157b7ebb97c406c1c62d7e

  • SHA256

    af23634579263656b8f66096ba9bd23ce4b5de406a1f739452a2869c7ed0488a

  • SHA512

    e83633d198d4ff082cfe8bb175b67da8e01a6a2f1ccb4c60de89f4077622984cb1b28bedf0383da9d7a602065b0c12a0d9613fb3f299752f4b3691ddb6ad756f

  • SSDEEP

    24576:zyK94r8JHq/p475Qh4rxZjIPAO1Ve8h8rumV:G1WK/Ey4rxZF6Iu8ru

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2