Extracted

• • Target

    79bf4926941553da03da58b35771fb2bc4731fc79b6bd09ab07f2af7c68ac398

  • Size

    1.3MB

  • MD5

    e71d748fed86fd7d54340aa2bda52bea

  • SHA1

    748ed2457c963f0597ffa6a5417d89e5b0ca0246

  • SHA256

    79bf4926941553da03da58b35771fb2bc4731fc79b6bd09ab07f2af7c68ac398

  • SHA512

    ad97974321a8fb06dd3fb181d4d3bde6dc1f6eea1f17577c86bb6a7dc9d558ef3b26fc8556299cd4f13c990064ba38af29ef90b97ea038aafb0d104d6fef5302

  • SSDEEP

    24576:zyAgQ13VeOSJbaeIIs1CyGdqSDHA9kC3ITBOL8rAF/6YQQh3j:Gd0geefuhGnTAiC3UO4rG6YQQh

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1