Extracted

Extracted

• • Target

    b62de8fa907d9790deab7e5ab2215e821b51bcf087f28779e6bd25a090c69757

  • Size

    917KB

  • MD5

    f13afce1f444cdec8c27a62238d88411

  • SHA1

    07934c2a88d49f311b8abd37e2aa28505bfc5ae9

  • SHA256

    b62de8fa907d9790deab7e5ab2215e821b51bcf087f28779e6bd25a090c69757

  • SHA512

    0b220aba330ca4c4c4f3d6ed3225856b993b77a147eb8f3393d258db6c5b9d9594510cb26704243373efdd2133dd90d66f809cb8706e38295f67b671b3591690

  • SSDEEP

    24576:Gy2pmTHsaeuIsmC/GTLYDryAwRMAQ+0o:VxTVet3EGY3tR+0

  Score

  10^/10

  mysticredlinetaigagooglepaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1behavioral2