Extracted

• • Target

    NEAS.ab16aa326faf4cba0bdcb9879ce176b2214dd08e1f9695e345c781240eef2e7f.exe

  • Size

    1.3MB

  • MD5

    f9062de6e6d699ea3a3ae0d534a42d64

  • SHA1

    5fadab0e47b5a401b6455006a9edf45d4875c637

  • SHA256

    ab16aa326faf4cba0bdcb9879ce176b2214dd08e1f9695e345c781240eef2e7f

  • SHA512

    938e0e0befeab94da8b4d1ec8ffccabbdeed5f0519652c42ff0b0c23ede0f045df0629dafeda0ea8e9fb8e982e0b00772e0c01309a746057acc440dfb7387371

  • SSDEEP

    24576:dycHre85QyFaeLIsYCSGgo4Dx8Ju9lKgfJKMF4SFZgFAxO:4YreKMeENfG+SJuDKgXFpx

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1