Extracted

• • Target

    f01e91d3435f42fc3461ee3c83939a565810698f0d103f0c0a3f93e1e8efc9d8

  • Size

    929KB

  • MD5

    03dbc56ad4fbd0943eabc90b51e2a48d

  • SHA1

    5e406541166bee80713c5d7d0841e8005ed66e5d

  • SHA256

    f01e91d3435f42fc3461ee3c83939a565810698f0d103f0c0a3f93e1e8efc9d8

  • SHA512

    fc1fa11e8cf4d0b2536e471759b24dd6819e807d70d815bc9875fb82500526c6c24ac0284766e2c34b36737c945288d92d55f1d8d5d226efd8b542116f99974c

  • SSDEEP

    12288:OMrBy90UaIcWyX00FW87GLJNE/jnLsyBZtiRTIq4XwcfG30/TG:TyRyX00FW87GNE/jbBZYI9gTWG

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2