Extracted

• • Target

    e7730343d0f4b4dc26fe7d260eeadddd09e02237c26135b4488f9ac44662a1f6

  • Size

    934KB

  • MD5

    120de394450773e7b0d93402df55af28

  • SHA1

    1b7f95cf7cefe82d25cae97a98ec6e455f9ab8d2

  • SHA256

    e7730343d0f4b4dc26fe7d260eeadddd09e02237c26135b4488f9ac44662a1f6

  • SHA512

    deed400ef2bf6c38cc3591a3d3263505f445b8f224d32f9f6b965d024b02a23fa3819c8c0a82898c6caf29b09a57cbbfe52c9741a36b0134d4016760394a055e

  • SSDEEP

    24576:JyJDVpnUlN4yp/z/BON2UdwqblfuyQ8G:8lG4ylz/gN2C/MyZ

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2