Extracted

• • Target

    NEAS.3cea2a4ea0be925701d0238777ac4957b1ba4b05c794a10b159e3a4c863fc4d7_JC.exe

  • Size

    1.6MB

  • MD5

    6f3b19a3b5ae4e680f1f1b4e67c17198

  • SHA1

    23b8c8a9fee9b60aa7d3e43988914658404713cc

  • SHA256

    3cea2a4ea0be925701d0238777ac4957b1ba4b05c794a10b159e3a4c863fc4d7

  • SHA512

    acc73976ad38385f67d0d6e23c32045fcfbff2be15f754642ba104882de41106ae60fefb6641b60fc88f5e87d4ce054821498033c74b686571a8a54a76c7ac31

  • SSDEEP

    24576:8y6ft9WxcIjlyQxhmL96QlaAiwvei3s1yL5durrglgBnB0FRztyLgoZrdA:r8OBpy7wQ5h3ssLwrU1tKJd

  Score

  10^/10

  mysticpersistencestealerredlinegigantinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2