Extracted

• • Target

    b11f693fd82d813661ae7ea1c14e556ea78b44f0929d86acda6bbbb5605df695

  • Size

    1.3MB

  • MD5

    843a86f746f9b24c050a35cfe80f5de2

  • SHA1

    bebe6032d056f3af104c1f3390b90e7b3c9abfb8

  • SHA256

    b11f693fd82d813661ae7ea1c14e556ea78b44f0929d86acda6bbbb5605df695

  • SHA512

    ede9473fe437179d83e3a0419f58c23f008104013501ad5522a53118a331b0936bed443904400783195cb7c6db687504549029ba369f1e1b20c53925b6947994

  • SSDEEP

    24576:VycERZzitZqXaemIsGCRG4+kDXllPnu+GavAG9tIasXL2Ibrn0:wRRFNKeVZ8GALPnJGaoG9aaEX

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1