Extracted

• • Target

    NEAS.b7feb3870acabfdcf3bca70bd2036b94862ce27f4f4ed71ba78e83dfd7b1db98.exe

  • Size

    918KB

  • MD5

    b72309222be81139937a5808c453346f

  • SHA1

    413b3b73df8186744f7d3e81d21dfbc016c01cb5

  • SHA256

    b7feb3870acabfdcf3bca70bd2036b94862ce27f4f4ed71ba78e83dfd7b1db98

  • SHA512

    ef7c7e833f260a07f38880aabca6ef1994ae90e8d65fc1e48128d29e66847b115637c1b55bc9a92f4dd5415709b9efefb731d9116a668c046b4f8fed22d8951f

  • SSDEEP

    24576:qy+kWaeuIsmC/GTLYDr8ym44058Du+en0:xJet3EGY2C+e

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1