Extracted

• • Target

    NEAS.e71b3e82dff6cfcb94c9c35deb7221b0.exe

  • Size

    1.3MB

  • MD5

    e71b3e82dff6cfcb94c9c35deb7221b0

  • SHA1

    351e87cfe5b2af1494feccb6df4e33620c9e84fa

  • SHA256

    d26b1be37b5b12691f4989956ef7b72ff6bf2ec8a670b138cf837211bd215316

  • SHA512

    a2ca4ed2845de981da45090dc338dea020eadfa4dfe4fce16e16b93673e9c17d3e19d010e8a0a898ce3f1dd2a11bbd232358242c0b8996532824282341d15d5c

  • SSDEEP

    24576:xyRaC4fcFQheOd6n6dEmX2C78BLd1o6/WKlOSD+cpljGI/5yXnt+5:kRB4EFQhesOh1oKlIkjGIx6k

  Score

  10^/10

  mysticredlinekedruinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1