Extracted

• • Target

    c461a6c13fbba7d761e9151b6eb589d2.exe

  • Size

    1.3MB

  • MD5

    c461a6c13fbba7d761e9151b6eb589d2

  • SHA1

    29421480ad9dac73e6fdf200ddcab7c402cf6056

  • SHA256

    e1765e1efd8044e90319786c6b1ab81d0a394711497c43d1ff57b0086548fd80

  • SHA512

    80fd1784996a660bd5618717a204b38e244df9f2e0498dd755a0272837b15654f00bc55e37c407a25343dbdb2b06aa244aca5023476c308d62ba2fca46f907fd

  • SSDEEP

    24576:pyngI0+2JNbjaemIsJCEGO55DSvP1im1s/hisYvXG1V8mRTwsid:cgI0+2J52eVq3GqWvP1idhlf1CuwJ

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1