Extracted

• • Target

    7bf2f95c02d6a67164588318e925ce09a8da25f5f5f71e50a3fcd84bf84c91f0.exe

  • Size

    921KB

  • MD5

    fc36af7f28a807d40b48cc4bc024e405

  • SHA1

    f99188c686bca68d4d092dbfc95a5990aaf59ccd

  • SHA256

    7bf2f95c02d6a67164588318e925ce09a8da25f5f5f71e50a3fcd84bf84c91f0

  • SHA512

    7d1a2ad317c02071e93d11db8e55ecc0094ace479f0ac07fa85f4063d44dcf755aec2458382c0592e9ed032c6a5180c9bfc6dd1042330c64e168c2d23f573fc7

  • SSDEEP

    24576:3ykoCVATWgaeuIsyC/GjLYD7wID3S8wuKxYsc5W9fQlWq:Cko+5et1EGIwsi8wuty9fQl

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1