Extracted

• • Target

    031c5ae0ba72c4d99478142b7e3549019b6141c6872a3abe18ac34d82b94c619.exe

  • Size

    1.3MB

  • MD5

    93a1b5069034f862883429b5017c08f7

  • SHA1

    361d8e67fed20f1af96292ca2e2bee2852c9af32

  • SHA256

    031c5ae0ba72c4d99478142b7e3549019b6141c6872a3abe18ac34d82b94c619

  • SHA512

    a610185d69355028829eda8a8d7656e8adc22147e92024a496e13241f6ba0b42f54449c31602e04b6d2c70403b8664ddc7e2e6e861e13fd5e2165970f1c313f1

  • SSDEEP

    24576:+yPVdRomNp0HMXae9IsZCOGE9bDTWNcTY5afm0jWCLBmbs:NPVbo4lKeuEPGc+N0Y5cm0jv

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1