Extracted

• • Target

    NEAS.37a81bd1ee8e13048f5a71bee31fa16b0065f84b90670474c4e6d9a3d5ffb32fexe_JC.exe

  • Size

    1.5MB

  • MD5

    aab63c233da2acf54393ba50f92bf7f5

  • SHA1

    8b94aaa8002c4ab6665d86dd079783bcc15a78ee

  • SHA256

    37a81bd1ee8e13048f5a71bee31fa16b0065f84b90670474c4e6d9a3d5ffb32f

  • SHA512

    a5eb6da1d6e8d2463c1ff70c0b7cfe4df4566cf910fae6ab018db1f2f0b724278e01a89a029c2ff00eab1f5abd4f99c215cca54c96e48a59aed4e0a1bb31e58c

  • SSDEEP

    24576:ByVjLdwJ4tg3Sc27AXy6d2n5HXMXsASI2ghNRXcgEI++YQygNaApK2j/gCP:0VjGJ4ux27od+5H8X/TEI++DGC

  Score

  10^/10

  mysticpersistencestealerredlinegigantinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2