Extracted

• • Target

    vi7vV04.exe

  • Size

    674KB

  • MD5

    1910ad4faa20f90c141ba6c0b778f677

  • SHA1

    33cf234a6d51a669d108b2a53534b183b4f6465f

  • SHA256

    d666f64b77184a008a653cadd4f7ae8886ddc5d65ac42c1bb9094506692ee12c

  • SHA512

    0a47d75e34dfc5e892afc555937f4e0fdca1959ae8068ff21ee60817e3fb65a82e89c283063c18678ee67630b48104ba4bef48a019afcbc52ba8326d28588f7a

  • SSDEEP

    12288:dMrEy90D0NA0H7Gae/4IC50pCCHGN0PLvYMXiYQbDL6gyBEK+wB7qkZeMin:tyWiaaewIsgCQGIgYD/H+wkkQMM

  Score

  10^/10

  mysticgooglepaypalpersistencephishingstealer

  • Detect Mystic stealer payload

  • Detected google phishing page

    phishinggoogle

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1behavioral2