Extracted

• • Target

    415bc147845345d629141179ad0997b55e1f50b6c6a73d35168254e89932d7f2.exe

  • Size

    1.3MB

  • MD5

    a56d4229df13e8297b82f3c974e74660

  • SHA1

    15895825cc3c1733bcd73e04c6f1a01da7f44ecd

  • SHA256

    415bc147845345d629141179ad0997b55e1f50b6c6a73d35168254e89932d7f2

  • SHA512

    9f9211bc8c2fd538f9627052b555f53cab669ec7e41485294c0bdc9573264cabd0ec93b865468f2cc3788416b18e46ac3e3b556863fa365bcdf07bb9af722348

  • SSDEEP

    24576:myeEJn2bHOtaewIsnClGsWGDE9O24ukaVXwo0gu9Yw1M0xj1tlkHbNNBjWV:1eEJ2Soe3mMGC8RkaXwodw1MS7lk7NNo

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1