Extracted

• • Target

    YR6OG72.exe

  • Size

    674KB

  • MD5

    4e460fa8511418b392d8a16c1509a9db

  • SHA1

    fc3834f223ad6d9bb905d3fb2beecf96c06e1447

  • SHA256

    9e8544fa92ad83c36016fedd7a17ea4b37bf1f887485802210fa0a0df8a52a81

  • SHA512

    6a230974fb1bbd4fc8999b6358a0dc91ac0776287374668745776c064d3170ebe88e38e092bae76d3244740f04f24f68ea4b79579b5313af5fac03c917782068

  • SSDEEP

    12288:6Mroy9010NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6c7CibPZDk3TJT:my8iaaewIsgCQGIgYDqei1GJT

  Score

  10^/10

  mysticgooglepaypalpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1behavioral2