Extracted

• • Target

    6a5e7d4ea61ed731743ed58fb3fbe1c75bb97b96eebac6374cf084d747280f51

  • Size

    1.3MB

  • MD5

    c7c452176ee0cdef6904540029728506

  • SHA1

    6d01f6b671109f689a7549d5ea75c4c56c2cc3a5

  • SHA256

    6a5e7d4ea61ed731743ed58fb3fbe1c75bb97b96eebac6374cf084d747280f51

  • SHA512

    6ebce152f15f75f8a2af6991b642ec27aeaa358fcb3825baec62ca414df29dfe58b3abab6f458203d571ca7facece1f47afdcc986b2a9afe62f7f6fd8de4bb88

  • SSDEEP

    24576:wyrqmO0Gaae6IsmCiGV2PDn7UYe1H8ekJ9A34QdvSUWj:3rqmrieBhxGAUN1MIZ

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1