Extracted

• • Target

    1e5309add481a6658511e0165999534278c5e119856e1a111d631ca7d8d6f05b

  • Size

    924KB

  • MD5

    5517f73ecd24fa9d53627b8ce7c4cecc

  • SHA1

    13ed6802d17741dfc57478402b8c3196b8b7aedc

  • SHA256

    1e5309add481a6658511e0165999534278c5e119856e1a111d631ca7d8d6f05b

  • SHA512

    81115f58bd93fa545162c14cc6a8ed13928dfed5a1a54fc30818dadc105e58a1fe8de68d29dcfdc1bb29d523e03732010b3d9a717abd570210a5f0a7d230a5ed

  • SSDEEP

    24576:AyGSlOJbe3w7XrzNM1Q+K1NaU4K9o2Pc65GoksrZonbf:HIJbwwrrzNS8t44Pc65Go6b

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2