Extracted

• • Target

    55b087ca72ace14d8303f9f107731393daea4b6d5c00a832eac4fbaa6a77db7a

  • Size

    1.3MB

  • MD5

    7dba26d81810ba290304c46ef7b58104

  • SHA1

    36fb016e980cf07a83311eef4656c8026c0635e4

  • SHA256

    55b087ca72ace14d8303f9f107731393daea4b6d5c00a832eac4fbaa6a77db7a

  • SHA512

    1fbddc56f5fe00619eab4866ceb4355d92e82059f57c453be416623ac66c9f91c8b6caa5c44c11be327a2061603bc38af6623441f41c8bacb1417155ac5107cd

  • SSDEEP

    24576:fyOOwMF0n5/iaebIsgCiGt5CDDTfzgj4EeJeouaof/JMTRkP:qOOH05TeUJhGKHbz4tgoXOR

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1