Extracted

• • Target

    1f351c6e17a289120d35fe4a1f0bbcdabd289d91fb249162fae7c50f3e3f4618.exe

  • Size

    916KB

  • MD5

    8333f53248f207b4fa7abaa1f900a261

  • SHA1

    b36b42f971c7069fca5383aa8eeeaa8e99f6a6f1

  • SHA256

    1f351c6e17a289120d35fe4a1f0bbcdabd289d91fb249162fae7c50f3e3f4618

  • SHA512

    95c92c8f406ebde3e5ca7aa4038d9314bb8fb884642cfcdaeea5a14027bd5448eb57abb0c63d847063094834d273f811cab6ffbf9c9bdd007c03a7feb3e470fc

  • SSDEEP

    24576:wyC5+n2UE50aeuIsqC/G7LYDPTDOlG1E89yHJohoZAc3:3C5o2UStet9EGAnDOYFyJo2F

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1