Extracted

• • Target

    3e85c5b90f8d7b3f2ae367c6b611bea63e6fdb9fae03bda7125cea8f77ae9d0b

  • Size

    1.3MB

  • MD5

    2ee5707b1656fefd192239d464d6aacd

  • SHA1

    9849c14b8829c3e7ffc738199fc47babaffe57f8

  • SHA256

    3e85c5b90f8d7b3f2ae367c6b611bea63e6fdb9fae03bda7125cea8f77ae9d0b

  • SHA512

    5836029135076e5ad11281277b7f3326353b355d8595122f3bfadf1c50650cd44a81b967fdb78910aaeb52269a521aad03f1f3bc4bc6cde85f3f825ef894ae0d

  • SSDEEP

    24576:gyNi2GuJ7FcbMiaeeIshCuG2vTDGGjoFwIfjox29rZSYpM0zI5JEZI8IY:nNF7jredOZGElGok9kWbzl

  Score

  10^/10

  mysticredlinetaigagooglepaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1