Extracted

• • Target

    NEAS.998cd3b724f9097316e5fe22e7bb1520.exe

  • Size

    522KB

  • MD5

    998cd3b724f9097316e5fe22e7bb1520

  • SHA1

    4021375178ed6bb61df72a3753ae952d76c3e35f

  • SHA256

    54698c1dfe50107b7104bb63530d76c7fed9c967e7ae8225a4138883bf6fe61e

  • SHA512

    2d323c5039f319b6aca3d8e334fbfb94b22ac278b0e9d11c4b929c96ee7cb50668ae4d0aaee2ba64f5b4a24b87e06dd84ad140c6edb61f0b517525d729882da6

  • SSDEEP

    12288:2MrJy90mEQLFlxnuUEcOtwf2GmZ2X47XPljTLLfSbZwVf:nylEO7nuU9kGU2c/libkf

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1