Extracted

• • Target

    dc1b52ebd2aecd0df73ca6d9416a0a4907539fae1fb69fabe81da4afa03eac3d.exe

  • Size

    607KB

  • MD5

    b0446b942eb5241dbe2495a3dff98583

  • SHA1

    d28dfaa2c39a82197542dd3806d4ab1c84131878

  • SHA256

    dc1b52ebd2aecd0df73ca6d9416a0a4907539fae1fb69fabe81da4afa03eac3d

  • SHA512

    e2dbde2c2701fa898945ee3e82ea774372ff675790619f0720221c79c06ff8fe441d5e5c9de2faabf8a50eca07a7f0102648d0e806b2b449e9fdd8a878f570b0

  • SSDEEP

    12288:mMrVy90k9J81CQog3GhFVYgf9voEGx3oy+z9t2Re65rJob/hGhazc:Xyz9e8QRGh3vebNQt2RBBYgczc

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1