Extracted

• • Target

    NEAS.05d037a65fe901edd329535b1f62c90fefd46fcd65b0044f950d1844f99d27f4_JC.exe

  • Size

    1.2MB

  • MD5

    f272d825d247bd60c96eae236420a4cc

  • SHA1

    83f48ef21e0ba65b7e3fee6faac5a2d6d5812d3b

  • SHA256

    05d037a65fe901edd329535b1f62c90fefd46fcd65b0044f950d1844f99d27f4

  • SHA512

    f779f19f35de26040336baed268c4a1dfadd9ab4cf59579910ccc88dd5ea88643c6f001824231113a4f838f8ff9f2fafcdeccfbdac7aa719e6e455cd2040282c

  • SSDEEP

    24576:MylGo/GvDR9is74yLtIwul++Ux1skVKVqoKxiv5V+JVDt:7lGo/iV9isxtIFuPTUkIvPEVD

  Score

  10^/10

  mysticpersistencestealerredlinegigantinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2