Extracted

• • Target

    6d26760a587fb8a383655cbcc5c10785886d3b15ea62adcea8bde5c75e3dd7ac.exe

  • Size

    1.3MB

  • MD5

    5e58c7210f9f0753d651e7207240e728

  • SHA1

    31b5afd364f5a2ead3433048ee999decf634b12b

  • SHA256

    6d26760a587fb8a383655cbcc5c10785886d3b15ea62adcea8bde5c75e3dd7ac

  • SHA512

    d5a3e34e5e83b2022f370f1e7431a32e988d67162b30d7bb23d4f347a501c3eb8f6dcc6d094f58d87d277bb3a609a6cd8af614c64acffa2989314f692d9eaac6

  • SSDEEP

    24576:2y15jmqo3i96mFae1IsOC0GjShD1IKAKqfV7qYJ0nK8pF9zhfNvK:F15jm9e6xe2jfGiiKte7Fend1

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1