Extracted

• • Target

    sM2EW04.exe

  • Size

    878KB

  • MD5

    66aa9ee458ad0edb7aa5e0f8b8fcc7f2

  • SHA1

    a5a73f3ce0058e38b65d3ffd33f6bf9923cb15a6

  • SHA256

    fee1e2d064f8d63550cc5ad4d9fcc24958ad0e2a75855bff761dca6466cdc021

  • SHA512

    2424f2c5dd8a91a00786ef89f50ee171e6dd8c03c71ccc38cd54cbab01c3de621afdb09e7848c07499daacd626994d95c753b9ea562c9d5a11d3f8df9b385059

  • SSDEEP

    24576:myrxQCaeUIskCtG8PYDk9a3DHeOeEkS0T:1reLezXiGjw9K+ZS0

  Score

  10^/10

  mysticredlinetaigagooglepaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1behavioral2