Extracted

• • Target

    012f273e7823dd960ded3b000bbf19481f738cb7f92b1e602fca49038c7f17aa.exe

  • Size

    1.3MB

  • MD5

    710419d0e6c14d032f33709e9178dd67

  • SHA1

    bc14381e9ba57d6a21258f85c8028f321ecb9338

  • SHA256

    012f273e7823dd960ded3b000bbf19481f738cb7f92b1e602fca49038c7f17aa

  • SHA512

    7bb2d3ad81c2c979c3afc65d692f08e88f6c3c4714098dc8cb1304fdacea647635b281a77772887dd9c9575188b0e48d6f5fe18854b7bb4d78ab8772c60ec259

  • SSDEEP

    24576:Ayc010TDtt7aeyIsVCkG1VbDzOY9i1UGqcKex7X9asdCq7ujCRRVJ9OQ:Hh10TD/+eJQ1GLubK3JedQsMq71R77

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1