Extracted

• • Target

    a4e2ed44bcb5af1d42736b226d1e67034d40ad7e691338192d7a7cb707ed0074

  • Size

    1.3MB

  • MD5

    e22ec350b2f13096c6675fe2a1c9beee

  • SHA1

    3a86234d300950498d0b7776cfb176c506b275f8

  • SHA256

    a4e2ed44bcb5af1d42736b226d1e67034d40ad7e691338192d7a7cb707ed0074

  • SHA512

    e319cf750210b1a90700ed451aabefd845b2349a7a864339f1074fba78b997aa70e735900beb7478c542c7ae6fc458c28d55ba49b1d76214910fbfeb9f3770d0

  • SSDEEP

    24576:myBQhA3LjilPp97aeWIsNCvGfm0DhnktEyuziwRBunypB1LavRHMkcvNPgA:1BjPilPb+eFEEG/eGyuz1RBbB1LavWk5

  Score

  10^/10

  mysticredlinetaigagoogleinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2