Extracted

• • Target

    so7Ob25.exe

  • Size

    878KB

  • MD5

    c58c9f4e5173387ef6305082bf93a4f2

  • SHA1

    f74c837516d76108d751368da09bcc2880a3dc79

  • SHA256

    133c6cf255b5e69c909d3791bc054c5b515a4c9dfa20e0a7410c9ff6cc06778c

  • SHA512

    d130908a3287d69911db6299c65c177658fc86389e3b69dc7b1284f510f169fcf54481c7ebef185258253164adeaf0e91cbccdc897d9db6a5c49a8acc5680048

  • SSDEEP

    24576:Qywd+sI0lC/GaeUIsECtGmPYD4Qe934N:Xww0k3ezZiGhkV9

  Score

  10^/10

  mysticredlinetaigagooglepaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1behavioral2