Extracted

• • Target

    28a32f9638a67e87dcdae1fec78c98c5607da1e128298e877a4c05aee9fbf79b

  • Size

    878KB

  • MD5

    f9683f2f3b23abb5f7dd8d38deba51da

  • SHA1

    00fa0e88795c73298943ffbaace0946e58586e9d

  • SHA256

    28a32f9638a67e87dcdae1fec78c98c5607da1e128298e877a4c05aee9fbf79b

  • SHA512

    adbf667203d83665098c9f63f10a093f58fb22e7d97603fc395c0f1efc1cae6253ad035526974c5daf7e1cc2ca9e468e99102d63e8e71e2925098ba204ada276

  • SSDEEP

    24576:lyY7aQOaeUIskCtGoPYDPeuOAF4hI9xjC:AQXez5iGPLC4H

  Score

  10^/10

  mysticredlinetaigagoogleinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1