Extracted

• • Target

    44f37bb3dd9e7cba33e2b6a022866af679a784848b00808597251e2ec6283ed7

  • Size

    1.3MB

  • MD5

    ef0ef77e1eff2a86dd0ab3fb3097d863

  • SHA1

    82e8096347efb87b469019d3abeecf8c292d7210

  • SHA256

    44f37bb3dd9e7cba33e2b6a022866af679a784848b00808597251e2ec6283ed7

  • SHA512

    2dffce757e1841d42ff2b6e386244225cb9d9af5c7849a014757a51c158e33433932cc3c97ab4a1bcb378b5f45411e7acc1b37cf80a60a2cb40b733ac11ced35

  • SSDEEP

    24576:MyR02ezLQ9raerIshCRGESCDm0LusImV4ax8ia0DRmWmFA:7R0260uekWEGOyaya+Z01K

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1