Extracted

• • Target

    NEAS.e80e4142f4e69d518e1ab2184a0292ab959456b7310d391d702c81a335c5bfc3.exe

  • Size

    1.3MB

  • MD5

    b15198c6b56812bf263a78afb0ed895c

  • SHA1

    f79e5aed1eabcad1e8fa7cd1fdd8563c037b3e04

  • SHA256

    e80e4142f4e69d518e1ab2184a0292ab959456b7310d391d702c81a335c5bfc3

  • SHA512

    57176879b83d9a37e4d7ffaa87594e06cebc91f7cbc27bfa39497132d11fe930d34502802e389af11ea5e1dc0be65e5ad1ae6bf906ab62b9119aa4d540d80ce8

  • SSDEEP

    24576:uybVpIeiofJTPqFE2XBaetIskCTGoLPDbLsE0JibR1fdOJswJtQ/Ds69HHh:9b4eiol6MeeL+GQ3LsE0o9hdAswzQLH9

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1