Extracted

• • Target

    NEAS.7e7ac7e61be5f361cd44ac01410a6d06080f6473ff11673648a79493db029f60.exe

  • Size

    1.3MB

  • MD5

    6ef9c837c916d04e8f0709e0f46db6e2

  • SHA1

    c73e33eed67b45f1f88ebec3392798d47bcefd71

  • SHA256

    7e7ac7e61be5f361cd44ac01410a6d06080f6473ff11673648a79493db029f60

  • SHA512

    e67c4891a046c060562ac26e8870b5d3d0efb6007840af5cef30397e1df4d93a9f1eee35773090dafadc12a622a530a9f6de3bde4a142a04edab6fb56e23ee49

  • SSDEEP

    24576:wyfPo+M69V0MxnpaeiIs5CuGu/qD4fFUQgGq4cgoOukO8XOHdCLQuQbBCKnYTAYj:339M69V0MxEe58bGreuQgCpfeNuQYUiG

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1