Extracted

• • Target

    682c22ad2f791ef9c22b6e34a03f21d556eee9176655a680f9365b5f40e4210f

  • Size

    1.3MB

  • MD5

    8996ebaf69a06fb129fbdaf404903985

  • SHA1

    a5acde35015c48611f186dccf9ef097ae7bfeaf9

  • SHA256

    682c22ad2f791ef9c22b6e34a03f21d556eee9176655a680f9365b5f40e4210f

  • SHA512

    072010484a1502ebb854e6120b5bde09e0f6bbcf5862ee5d1f555be85a39821f45ea3d04d5af1ad45772f4ff7723127687b4ecad381adcf4c812258ec321252b

  • SSDEEP

    24576:tyiFlHKnBgaeTIs8CLGOvPDknJLAhxCT0aIKAN6DTPKC9eI+EQ:IiFlqB5e8/oGOiyxCT0aay

  Score

  10^/10

  mysticredlinetaigagooglepaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1