Sayad (Flying Kitten) Infostealer - malware analysis

This analysis details the Sayad infostealer distributed via phishing which unpacks a binder and a .NET DLL (DiagnosticsService.dll) that collects system info, browser data, credentials, chat histories, VPN/RDP/FTP credentials, keylogs and screenshots, encrypts the stolen data with an embedded RSA key and uploads it to a hardcoded C2 (0o0o0o0o0.com / 107.6.182.179); the report documents process behavior, persistence via HKCU Run entries, file hashes, YARA rules, and suggests a possible link to the Ajax Security Team.