Extracted

• • Target

    f4fd774fa7ec3d40dd6b827acd17e8d63102ffd06487bc4970274c5cc6034f3f

  • Size

    1.3MB

  • MD5

    262efff32362f65228176ce38014a5ed

  • SHA1

    442a24022cbfcbfb74069e27b2e7ffc02838c1ba

  • SHA256

    f4fd774fa7ec3d40dd6b827acd17e8d63102ffd06487bc4970274c5cc6034f3f

  • SHA512

    7af8e0124a9661589c953a97b79e2f7839ba56640b5d4d0eadcb3fe9737f61d406d3779e2e0cb949f985ec2c702d5d63abf23658fc1753926a5ccea8dad9b4a9

  • SSDEEP

    24576:Kys82jIYF3PQ2JRY4aefIs82CzGz/rDPqWLlIPWIz5L2ObukD6Q0Jrhro:Rs8AF3PNJShewZ2wGfJlCL3d6bN

  Score

  10^/10

  mysticredlinetaigagooglepaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1