Extracted

• • Target

    4727a1d0474ce49aaf736e5adf1b4eb1aab534e3366be7b16ee597787208d096.exe

  • Size

    917KB

  • MD5

    93bc18083d1d0ce5a24ed83862e6e2b3

  • SHA1

    9efc1147e9e079812a68a5b68d0703468ce088a5

  • SHA256

    4727a1d0474ce49aaf736e5adf1b4eb1aab534e3366be7b16ee597787208d096

  • SHA512

    266b1220d5e5c13b290e20c9b6fd7a2f87f18cafa56767030737e2be9c6c550735adb557eaefb906ae449d893485fa92ef08607073dd35befcead5de0faf9b55

  • SSDEEP

    24576:iy+xEOR5AaeuIsmC/G9LYDj5lrbdnzyJX2DXGS:J+xxnZetHEG2xlvdnzC2i

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1