Extracted

• • Target

    NEAS.c05591f745cbabd44158ae3823bb58f230c0d8acb2210502d626e1724265d0b7.exe

  • Size

    373KB

  • MD5

    896200690a2a6ace88febc8b4ecb59f7

  • SHA1

    d3eb645567d656612bf76cd42a510bbd5fa8196b

  • SHA256

    c05591f745cbabd44158ae3823bb58f230c0d8acb2210502d626e1724265d0b7

  • SHA512

    dad6d27cc465d112d5e8dd4ac2f1ae20e20ac474b33088945207084586173dd8a270647352850b121c2168f116845a343be314ce5f088c4308aa9809bae373e3

  • SSDEEP

    6144:K3y+bnr+Vp0yN90QEEsrTqIhsgUGsz7ceTP7qvH84+IgRq9EoDCKff5KJSP9jF2y:NMrxy90zlhlUJzXiU4+LqlewP2LO

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1