Extracted

• • Target

    341de31fe162829aea0a57251e41f427abea54aedd28da5268be2dd772edc0da

  • Size

    935KB

  • MD5

    a869a1c9a96a8b1692499debb5e1980b

  • SHA1

    f8ca3479d77c3e375102695d38320a0c853323e1

  • SHA256

    341de31fe162829aea0a57251e41f427abea54aedd28da5268be2dd772edc0da

  • SHA512

    233ab81463457f97fd7f4ffe2fbece5db6aceba9d0d4d2ea918e5c7a1c31e4d947a03b90d8e0c9b65818c41f76552314edbbbba08f62098fbde817a08ece55f8

  • SSDEEP

    24576:VyhTF3SDKLntsWFLUjEFf2DpEEev03fv:w+KLntDQjkflEev0v

  Score

  10^/10

  mysticpersistencestealerredlinekendoinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2