Extracted

• • Target

    142d4ff0272f0b464b92a1bcb6eeb3a4c0fe891b277cdf0457c7ba6309c40aa9

  • Size

    1.3MB

  • MD5

    b3250d5337fe39d07b41358c46cbfcbd

  • SHA1

    677797638c6d03a9a78c26889db7bd169c6ced7d

  • SHA256

    142d4ff0272f0b464b92a1bcb6eeb3a4c0fe891b277cdf0457c7ba6309c40aa9

  • SHA512

    9258953c7ff61335c8a21d19cd4300131c18a8728ddfca05130b7ed8bf68624ea8ac9188bb27908b5e3c7913bac996d7228d938669668e4bbdf7df5af4b52f81

  • SSDEEP

    24576:jyaOMPL4F6Gvnp/2KaejIs7CJG8ydDBSvcGREIdrGrcTwUZI5c87ij2+rUBrdODg:2CPL4IW2jeMs8GxdSvcGRTdwUZI597i7

  Score

  10^/10

  mysticredlinetaigagoogleinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2