Extracted

• • Target

    777a55eb14aa4061e78d16365d648d31317770f2d65f184e011938b9c07e09f4

  • Size

    1.3MB

  • MD5

    e47cd6af8cf705fbf1bf9374fa6de1dc

  • SHA1

    043526f86495d8f32b7d6fac3fa97a5a4aa4d3d5

  • SHA256

    777a55eb14aa4061e78d16365d648d31317770f2d65f184e011938b9c07e09f4

  • SHA512

    836d76cd86105efbe7ff8e1eb860e7f2c5913d213896828c12d3ba96a2026be26a25991cad2aa5c7aca10c0b38ff6eadd981f0b836067f66089924574993183e

  • SSDEEP

    24576:ey7bUyfN1FuaekIs+C/G1h3DS0tN6Vi5sktaZmVEabkj2E6h2afO5:t7bUyfn1eDLaG356VKtzF2am

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1