Extracted

• • Target

    91a798b3956baaa0085d36ea93cf65283e74075bea9a5059f27090032b93195a

  • Size

    1.3MB

  • MD5

    ccff498344949b2a53660d23efe60e45

  • SHA1

    b75d8f869111061e5ead3c47aca42251e7b6531a

  • SHA256

    91a798b3956baaa0085d36ea93cf65283e74075bea9a5059f27090032b93195a

  • SHA512

    89c28965531bc4ba0ad00198e04311ca6ad0057487376e0b4521302824ccd3a40a14fecad81789a9fa93c8ece487dcac7d0b0cd2409392d0daafcde9c6249614

  • SSDEEP

    24576:Ky8quKWSjo3cae0IshCIGB1cDJxWa9QNYBv8rmC00NT0XKN8AknDOo:R8quKWSU1eTE9GM7WauyBI00pMKNfkDO

  Score

  10^/10

  mysticredlinetaigagooglepaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1