Extracted

• • Target

    9778a0701e781d740705fb88ea0f715dd514c82b668169a5c528c003ecc409cc

  • Size

    1.3MB

  • MD5

    a3f79860c71b1a70f7ce528ac220a16c

  • SHA1

    469808b162519e3e6953330810c5296d6d5d962d

  • SHA256

    9778a0701e781d740705fb88ea0f715dd514c82b668169a5c528c003ecc409cc

  • SHA512

    329af4a15298ad71e0f04775c5e5ddce8da1f7800c62418b951c91d385c900c65f911bb9cc57ad71f24478e8379e7e99bb0c25f719ed67935eee22ee047c9444

  • SSDEEP

    24576:mypoN0fPLXVXPopvaexIsNCQGzsqDJOaO6WnTXK00KqmsIyE/fwhp6:1pvX5eSeqyLGbmB6mL/Yh

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1