Extracted

• • Target

    55ba8f4b3def792107268f8745d1a976e524f2795492875345e05b02252d542c

  • Size

    1.3MB

  • MD5

    cddd3bc23c4e669a370bc05e93d6daa7

  • SHA1

    72b8bb413ffae7845072b34862209cb7153d71eb

  • SHA256

    55ba8f4b3def792107268f8745d1a976e524f2795492875345e05b02252d542c

  • SHA512

    e5ae251d762a09493f25e5172191254bef7ff45c85b4cee2e39217c2eb494cd051ef0edbcda389860bbaea745d3a8f7547c83a34b244eb578c6da806c1717298

  • SSDEEP

    24576:rywnMHSmTaeMIsnCHG7ncDd4K6XM09qwMlwV/n5w/29:ewnMBme72kGo2lM09qrwrw

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1