Extracted

• • Target

    e9ac578be907dd8620c4f07a14093563ea4fb9b43d0342547ffdc9ff9d7ffe98

  • Size

    1.3MB

  • MD5

    94872dd4149a32ad0df4f44d402bd271

  • SHA1

    2db1f1f7631931948c4a3c92684548fb36820b78

  • SHA256

    e9ac578be907dd8620c4f07a14093563ea4fb9b43d0342547ffdc9ff9d7ffe98

  • SHA512

    e08b7c427fb1ec178ec6d510a63e83f4b8620e5506c07aa162fbdcf907973f9889057936fc015d126c323bbf14163e15530f5fb76a227e9a5f1f23442b9dc497

  • SSDEEP

    24576:PyexWG+JvXPLaeaIscCEGXVtDOUoqUMVhXe0xYkqinp0rMiXkYDEy:aexWGAfOehLZGHydtyhnxSWyrMq

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealergooglephishingspyware

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2