Extracted

• • Target

    084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303

  • Size

    1.3MB

  • MD5

    2e9a2497666c4958ed906e7cae0ac52d

  • SHA1

    f0a76ba69d2c80637cea4aac6f260152ca0b8884

  • SHA256

    084c98a06d49a19a4412caaf3a224b2083f1a52f28a5a891dc4fb91760bed303

  • SHA512

    8140d0357e97b494a0244903c2e6b7d6745e201b5e6331fd6e6dc6774726069222f0124d8e9185a2980859f415b4ce44530d70c438d227000ec527a4874ea25a

  • SSDEEP

    24576:my2rDJsp38kgaeAIs1ClGZg1DPWOVPmsSWFg0hqL1dTvZn:12rtsFL5eHk4GOLWnWi04T

  Score

  10^/10

  mysticredlinetaigagoogleinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2