Extracted

• • Target

    3aa760f9a4f0d96deb9e6e8bc4d253e765f29b55efb2e8e1902e9675643b1cd4

  • Size

    917KB

  • MD5

    0e4b3fc436a40ea1d3401f75d1721d9e

  • SHA1

    53ab8b6ca7a7ebed9ebcbfce3793982f915f44b3

  • SHA256

    3aa760f9a4f0d96deb9e6e8bc4d253e765f29b55efb2e8e1902e9675643b1cd4

  • SHA512

    b26e566e76df8c650bb73f75e2f492de57b36472528b41d22e5ea055c29e5b86af6a9e2d0b830cd56b9011d2b9e70bb735f390a8356dabf282a5a5e57ba7012f

  • SSDEEP

    24576:8yymoEsGnUaeuIsCC/G1LYDYyRawHNuG/Q:r/oEfNettEGOPoSNn

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2