Extracted

• • Target

    NEAS.1028758d81311bf28fd1a39e9894a3b130c1266ef4daa07d94061457720675c8_JC.exe

  • Size

    1.2MB

  • MD5

    d70c46a0072fc1e0f94041d246d1a307

  • SHA1

    b4a3a84383351e58bbc6bb48ecb637cee267006b

  • SHA256

    1028758d81311bf28fd1a39e9894a3b130c1266ef4daa07d94061457720675c8

  • SHA512

    57fa598d5f53dfea90d313cf0d14cf1802d98293412bae1f6980ce5cfc61f882c87ffbb419e3bed6b84aebd6fd988bcbd967e340dc9b50a90a57da9f07c1def3

  • SSDEEP

    24576:Yy4MSznBqLQn6kMjCV0KcxdA+XfzzxLxz+o30xumJJlZ5Yjsm:fhSdqLQXMfVxWqzzxLre/Zh

  Score

  10^/10

  mysticpersistencestealerredlinegigantinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2