Extracted

• • Target

    Jw9Xw49.exe

  • Size

    877KB

  • MD5

    75622ee3388dc2fef5a1362c865dc17e

  • SHA1

    25bedfb2472c2e5ad5c25b3d9b95f6daa561dfcd

  • SHA256

    906c7d044497af179ab7cc5f3057a4f466a2025cee5fe7cc70a4c5ab88cec5b8

  • SHA512

    55f18108337eacb4c884a3d7dcb8a0234113ad1a03cdda2e91fb61caea8e99265d98cb52087a3569c91f2d234a8b1640a275f4bb5230d2826d4d789ffce528ea

  • SSDEEP

    12288:VMr8y90wBXrzO8ZEgGTae74IC5ApClHGs9PLvXMXiYQaDvBR01On0heHD2HCSh:hyr5m8uRTaeUIs8CtGqPYDDkOCeHU

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealergooglephishing

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2