Extracted

• • Target

    2aa18005701a5f9849626f2c13a523685747bc4483fa5c636526ecc93470e287.exe

  • Size

    542KB

  • MD5

    8370b60c28384b713c9e7be4ea7f2c5d

  • SHA1

    634115b61dd93f620f150c21d836e345d1e1e459

  • SHA256

    2aa18005701a5f9849626f2c13a523685747bc4483fa5c636526ecc93470e287

  • SHA512

    82774a9beb2b30b2b099f7e8d668588c2f7147f4f889e162ee1cffa066f70b466959ce9ea4459757a442dead93e9438363b6c42cf3d6866972a43374f6224c3f

  • SSDEEP

    12288:aMr0y90pRsPTWGxXx+zFPXK1PlJq52U0G3sz:CywITdB+JPXIv2z0Xz

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1