Extracted

• • Target

    NEAS.a4fab58cfff9ddd79c0d4cdfd8de4020.exe

  • Size

    643KB

  • MD5

    a4fab58cfff9ddd79c0d4cdfd8de4020

  • SHA1

    7326e468fcd49b5c381d5f188906ba94ed3ee0c5

  • SHA256

    a555775d27b965ad4eef2919173dda2965e9a9752c64abea96104b2905bf6fc9

  • SHA512

    f3fe80b2fc5795a74e885997eccfee1e8628c425aa525721280e834baf3c04d99b4f33e00d02971089980c089d423e0ebbf8a33c60dd42199a91e015e70157e9

  • SSDEEP

    12288:DMrIy901z3rVYOcLE89QaDJnxuUPFWJeeVbIgHSicWtr:fyGDrVXoJnxTdCeUIgbntr

  Score

  10^/10

  mysticsmokeloaderbackdoorevasionpersistencestealertrojan

  • Detect Mystic stealer payload

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1