Extracted

• • Target

    ca4657dc6bccaa562f4209ccb37e5fddad1f2b60deef223031f752e4f486a106

  • Size

    929KB

  • MD5

    07a3992da323757a1f477b4edd59aecb

  • SHA1

    d0ea3d5f49ba6631a2eba4561030a8ff8859da18

  • SHA256

    ca4657dc6bccaa562f4209ccb37e5fddad1f2b60deef223031f752e4f486a106

  • SHA512

    8234ad6971a656f0ce2e92387a65eef2345bf281fd5f15532582928c42471826efdc04adf3b7e68a6e2f95666382b2e82de3fbae9b41d24fb83807e8accaa345

  • SSDEEP

    24576:JyfkQ016xeUl+BeoQWR1itBfJrqxUdAUdObjJfZmT8DOtMbe:8f1016Uc+4oQWqhrhdYjJxmT8J

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2