Extracted

• • Target

    NEAS.2b59c6080f752ad965267461dc8bf430.exe

  • Size

    1.3MB

  • MD5

    2b59c6080f752ad965267461dc8bf430

  • SHA1

    c93fa715a9bfdaba1a0009a5f7f826125c5579e1

  • SHA256

    ff57691d66470d2461913d6f28816d2a53f4a534f0711dd2aa62fecd1a47ca22

  • SHA512

    fee1dd9fb1aeba0cb2f36e0279bdd75ce36356ac661cafa0e8357713923830919f347fad70bd400432f7626e797b7ab2605669ce0934fe1128a3ba2cf33ed0b0

  • SSDEEP

    24576:0y4nGlGm+2As9ngaeVIs+CmGCksDrk4CIVs/ZR2fBUNzH2OAknP8XbB3:D0GMJ21F5eWh/GgHNCJhRrzHF1Ib

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingspywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1