Extracted

• • Target

    c8efca5094f4a78665dd1dcd1dbeafe4f82c1f32beb26f94309a855440b326f6

  • Size

    1.3MB

  • MD5

    723d04ba45ae96615f5bed058b6bc02f

  • SHA1

    eff3e808fe03b3ee9bc962e29ec36ee5a9c92070

  • SHA256

    c8efca5094f4a78665dd1dcd1dbeafe4f82c1f32beb26f94309a855440b326f6

  • SHA512

    824ab08b8a5912a35a5587e12c750817416768b959c05f6e5166085489d8fd9eff42b82a0dd830a71254564a87862fd08ab7af84ac824a351292a85b5d0b5f93

  • SSDEEP

    24576:/yiuiK1+v3vFaeDIswCaG1ebDRrewEuuPmOih3kQ9QUSoqaY:Ki9K1+QesLdGI9omOwx9QToq

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1