Extracted

• • Target

    864800f97463762e22ebb976c3b3cf8c54f869b5f8cc88d116280cec9088c169.exe

  • Size

    1.3MB

  • MD5

    ad217868ca3748bb09059de2833fdc0f

  • SHA1

    64fb98b5c6a635351f8d9373c8de9a671eef6ff3

  • SHA256

    864800f97463762e22ebb976c3b3cf8c54f869b5f8cc88d116280cec9088c169

  • SHA512

    4f4c21c9b2608bafdf9427881a95cbb9a5b345f9e9ba629f201aa474ce678524814bef71b88233a7eebbcebe2756ac2b2617fe7153197ed298c8d33e55a0391b

  • SSDEEP

    24576:Pyd+m+Bis2HFaeUIsmCsGMYUDruT3synTxMc4ZiOjXLvTZ6r6bN:ad+9HKQezhVG2//yTxMjZZbS6b

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1