Extracted

• • Target

    03c1c89b52ac16038505053b5b863c06f3901a4e6516460db8222d2cc0e7edd2

  • Size

    917KB

  • MD5

    287f23ac8aecffbdb7e3c33d39ae10a4

  • SHA1

    e5be308f71d7e5e2a8e533d4cb9ee271ddf04d2e

  • SHA256

    03c1c89b52ac16038505053b5b863c06f3901a4e6516460db8222d2cc0e7edd2

  • SHA512

    f69bf278f61a40bc135b42012bdb266ba9764ff6a9d8d4ccdc27755975548b1409c895a1c1cf35fa98cf3794223461eacadafd54b6a421eba357fcb1203570b6

  • SSDEEP

    24576:wygZo7LJ5gaeuIsCC/G/LYDLnxo7k2xzpFVGKe+hiMIc:3gCP5etFEGEmNpfG/+

  Score

  10^/10

  mysticredlinetaigagoogleinfostealerpersistencephishingstealerpaypal

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1behavioral2