Extracted

• • Target

    708830dc86a26467f9ab022c23c12e0754a01bf91863119419100d7e45c28dca

  • Size

    1.3MB

  • MD5

    28372994d8e1104592e45797dc638e8a

  • SHA1

    e7e99d5af99c389447af25ed1f7edb7844827959

  • SHA256

    708830dc86a26467f9ab022c23c12e0754a01bf91863119419100d7e45c28dca

  • SHA512

    00c6299951eb02aab117086699efad9c4abe85511acd10199eb5274ac610ab37c017f341999dc6fa83f5f579361fa267bbaaa0a3653317656a00ecbdf6ad46a1

  • SSDEEP

    24576:/y+1845T+DXeaeAIsaCYGKLADA4iXs2Ntfzon8zXP53y9ri:KK8IqDXneHNlGfGl3fzo879y9r

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1