Extracted

• • Target

    bf3e98eb2bb8da5e5a4005d9f77f6d0382e7baf05ca32299ec7284b12254283c

  • Size

    1.3MB

  • MD5

    d6d5e6d04040be4b2941a46956a69ee9

  • SHA1

    f13d7bd63b403dc44af52fb23b4d1e58f8a1699a

  • SHA256

    bf3e98eb2bb8da5e5a4005d9f77f6d0382e7baf05ca32299ec7284b12254283c

  • SHA512

    1cc9fbfeb275079fe45fe3d94545a349704fc96756a1abe99b462586931cb549534e20f27229fa45ef302e1cc208dc4f6c620d78b5fc62905ec8ba5cfc391dc3

  • SSDEEP

    24576:PyISr6WgRN4ae5IsuCzGpo1DBJPjgVsnFrgvFXotQKQSlbtEFdEac266cbU:aIY6WsPeifYG87PjgIg+kMZi+9b

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1