Extracted

• • Target

    NEAS.30ec8753ba08b1b439e43e84a4f02e90.exe

  • Size

    1.1MB

  • MD5

    30ec8753ba08b1b439e43e84a4f02e90

  • SHA1

    a872df7ec9adaa22035b161ce6dad745e89a5a5b

  • SHA256

    775b7a04793f8621742cc362f51bef7b4d75b10169fa3493b7c9f713d38fa73d

  • SHA512

    593f922e0291eb7127041f4ce9868924817a3534d4dc67d69bc11127b721f2f33bb477654f4d74828d004d29c5862acf9f3022b706f2080cf238b8506325bd60

  • SSDEEP

    12288:+MrQy90QW+wWzj3Q6ks5eE/2NowcE/WEaDSEHxm5QsVGdqZnZQqHSqSyHU8GB88j:CyUQrtJE/WEsSWI3VlZQuhGBPni3O5t

  Score

  10^/10

  mysticpersistencestealerredlinekukishinfostealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2