Extracted

• • Target

    Fe5ze95.exe

  • Size

    880KB

  • MD5

    c696dd68af2f68c3f3b4198ade807231

  • SHA1

    287e72132a755fd745669ec9f4baf9ecd69cc6ad

  • SHA256

    bde41dcb73f43329f1390c95b3b4586304d410fa1d7dbab39f96a43a988f6138

  • SHA512

    374f66b405157817fbd47798dcb9bb166e2c8e6bb9a5f712d766dc576bd74ac2588319b2577f248f533884d528f576c84393246da669ea271ef730b9a3f80a8c

  • SSDEEP

    24576:0y+q/3bZnKn1aeUIsACtG0PYDLQ/9NNGjT+J:Dr3VKnAezziG7glNN

  Score

  10^/10

  mysticredlinetaigagoogleinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2