Extracted

• • Target

    96968eb7438ab298fb5c8dd0b46b2e10a77ed78eb2a54c891b40da4da4a3b9e0.exe

  • Size

    1.3MB

  • MD5

    ba1d6c925ec0867f51a06eb45f780f65

  • SHA1

    8739f0e00cabe3fee69ce50561b716c701038177

  • SHA256

    96968eb7438ab298fb5c8dd0b46b2e10a77ed78eb2a54c891b40da4da4a3b9e0

  • SHA512

    dc627b7c2f4273c7c5dc7d1721f0b4fa766ca732831ea641d605ae8b2ea9f1b0f2ec13f302ee30c8cbdb2c16d015f3486d45024e636bc3c08e331ec7cacba899

  • SSDEEP

    24576:dy5443gK+dy+ae5IsZC3GRW1DeUZf1R917qiIvQ75BxdVocaM:4aEgEHeiq+G4Pp17zLtBKc

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1