Extracted

• • Target

    74b3befc9686d94843e6a849b06b2604a1cf6a217ae018f92957625163b1eaf4

  • Size

    1.5MB

  • MD5

    3898b194d4ac6efab353559cad90b8bd

  • SHA1

    02daf8aafa7b5bd0d74975b5340b93ed201d55a3

  • SHA256

    74b3befc9686d94843e6a849b06b2604a1cf6a217ae018f92957625163b1eaf4

  • SHA512

    fa31755ff093c87e14e4e699490fd71760001daad872d7a41d379cfb0df4550042879e0827f6f794efe72a0a586ba2c4507e6e24ff5695d8871df08ad3db9015

  • SSDEEP

    24576:tyBtuMRKoxMAhm0eRIs/HbGJ4eDGHCPwNnpYVnk5EMxGt2+dp59sFAX9obC4h74W:IBtjxeKk7G9FpVnkVkc+dL9sFAXaCK74

  Score

  10^/10

  mysticredlinetaigagoogleinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1