Extracted

• • Target

    NEAS.9d6d022c70611ba628da7b718a0b7ab0.exe

  • Size

    764KB

  • MD5

    9d6d022c70611ba628da7b718a0b7ab0

  • SHA1

    d3daa97c52a5ffb64a04a297ad8deab9c7fcf760

  • SHA256

    83d5d197881cace05f6260ed8d0b91e9fee2f637cbb0017c1b5dbdf8f8bd2b5a

  • SHA512

    b54d7f3838aa82e4ff85eaf477bcf35f2a45c8ca86ade69ea0e8be414fefb59cbbedffe105d3cebe8b297ab84e698921a958c4bcb81b868fecafcfe59eb803de

  • SSDEEP

    12288:MMr1y90P/vGzKdHMXHqU9Dvkxm8LFIiTNhT9ZneL65+MlMdjpQk8nf7pO:5y8/v1UHqUhlsqiTTrnHtM5G3nfE

  Score

  10^/10

  mysticredlinekedruinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1