Extracted

• • Target

    b0dd0aeb91f5c5350cd99c528af017c7cad9a73167c14e0e478b59c8fe1828a4

  • Size

    1.3MB

  • MD5

    8595c8e0f4acbf44e4d0ab2a69fd6aa3

  • SHA1

    e5904fe2e5f9b014bae0f6be9896e9b733099f76

  • SHA256

    b0dd0aeb91f5c5350cd99c528af017c7cad9a73167c14e0e478b59c8fe1828a4

  • SHA512

    ba6f0d087d9f67908411f3b5c6762615fcbaaf00ed5538f685f7dc1eb10b012771485a9f3a41e0b3de99de0cb798a18536f01aef674480d8258762d5e3b49cf4

  • SSDEEP

    24576:3yISSXnan9aecIsaCIGshPDU2VwWG0+iHjHxari96Y59q03Ar2sS6eg:CIrXnDeLZlGcTVwzJiDwq6L0Qr2Qe

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1