Extracted

• • Target

    d27450c2663f8e8908c34f9ca27f71a7e8991a1ca1ab20ca050031702fc8f110.exe

  • Size

    511KB

  • MD5

    6b6ffed210fddf1c28b834daee8a4b4f

  • SHA1

    948668592940cebb02af57f3a04228d6c0597ecf

  • SHA256

    d27450c2663f8e8908c34f9ca27f71a7e8991a1ca1ab20ca050031702fc8f110

  • SHA512

    1a8b703a153e7c9f797b4ada63e6e3e9ea99297b36c5cf2e73f610ad1ae5e8e59540f12b7a9f3c2771b0f9aef417a9d8c205a3f76f16935de345426630be72d1

  • SSDEEP

    12288:SMrNy90D1B0xV8zw3wHjG9Y8TUs2euF+4+wSRoFCrGYf9g:fyUbfzcYSz2eu4USGAZ9g

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1