Extracted

• • Target

    NEAS.db7b03642dd5c82aba44181a5259950c82b933e6d10cd61ce0fac64963ccf003.exe

  • Size

    522KB

  • MD5

    385f90628bf513506821f7c735a7ee7c

  • SHA1

    ade08412e713f641d7a42aab72338062aa22d54f

  • SHA256

    db7b03642dd5c82aba44181a5259950c82b933e6d10cd61ce0fac64963ccf003

  • SHA512

    5bacee59f5e290660b74b703123bfd76a57f07d064dd47d1689666393abb3da6676cec4d7ea0d12bc1c277ee179a267384058c7be7c1055ec86e5f01973eff34

  • SSDEEP

    12288:MMrVy90bXZflRQYNCVNsD9J1Oap7k1KlWAYRZ:ByiXZfXNwNspJ1OapIr7

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1