Extracted

Extracted

• • Target

    kY4du58.exe

  • Size

    880KB

  • MD5

    710fa0e7598455faf9ba567d56fcec0d

  • SHA1

    1576ba8ce102b5c84bbab15e1bd00676198f9b98

  • SHA256

    1b4d674824b2a1d469ae4518f8ac9fe7a1631988a251481d8390525eef9c423a

  • SHA512

    9b3e9efe2343f8c7bd23a1afe0bddebf72ad0cd2eae521e029099043a3780d1acca0cfda9c27475c5a418debe9ccad2bb12c5c67142a209632d34f876d78f1d7

  • SSDEEP

    24576:0yEvPG5JaeUIs8CtGEPYDJ3SH0ybaSpl:DEvPwkezhiGL8UybaSp

  Score

  10^/10

  mysticredlinetaigagooglepaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1behavioral2