Extracted

• • Target

    NEAS.92fcba02829079940f3b9eb68d51f5ec8a7d24415061c1e055a266cf50c39af8.exe

  • Size

    522KB

  • MD5

    928d302bab98caf3936ef7b66068127e

  • SHA1

    fb979ffe462ae67b99172e5999722008f8bf519c

  • SHA256

    92fcba02829079940f3b9eb68d51f5ec8a7d24415061c1e055a266cf50c39af8

  • SHA512

    a6448941e57b8d65a3d76bf8176b011aa57e2518eee061d2178fbf81b35928e556b6296f6bbc8a3ad07793b273478c06c7f5118a23420b5c5e3d17d5c0704551

  • SSDEEP

    6144:Koy+bnr+Zp0yN90QEN2Ye6FlquVUZVoQWTMHqudJRNbiFDyVMI49OG4/t9Jk9kSF:MMrly90yYtpkVG4D1iFD99OGEJbWI9e

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1