Extracted

• • Target

    NEAS.95ee9c18848ba7cd4e4b753d8f82bc3605c097ef4178d9781b12c112ebf43fec.exe

  • Size

    1.3MB

  • MD5

    77e775a19e7afb113a5c6b303f9fb06e

  • SHA1

    4a5e82d49bf22335395742e9c38f276c429030ce

  • SHA256

    95ee9c18848ba7cd4e4b753d8f82bc3605c097ef4178d9781b12c112ebf43fec

  • SHA512

    40315ee49506d0ee8f4534e85672c711b7efc9f5058505d39c6460a827f1ea451c590bef4aad3970e9b654bcc29e4da6b33904ab23491c15ffa772b8e8a4c32c

  • SSDEEP

    24576:DyRMtUHIOereHaepIsECJGbWxDMY1r8zbSIEJVjQI7DX/rYN7K1r:WRMtRDC6eSvMGO1RmbJE3MN+1

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1