Extracted

Extracted

• • Target

    NEAS.c5dd9eba76428ceb4ecd645998781f90.exe

  • Size

    570KB

  • MD5

    c5dd9eba76428ceb4ecd645998781f90

  • SHA1

    5f99d75c3ec9971b69b2a4a0a0661e923671866b

  • SHA256

    99686dca69444efc0d94a9dca047a595867bc3f14e4bbb2880ba7c3281634bfd

  • SHA512

    ba1eb01ae0043ccfc456e7d56e649be9d8a5585fd570cc8dd96bdae0ebd38d5a5bc9c45822b41feebbadf4146d83bd42ce6e528fd9d5776b57203cab37c32c97

  • SSDEEP

    12288:0MrIy90Ue3X9P7w+GwY8TUs2pu1gI5m5J4OjWiWk++5Bdu:8y5UP1YSz2pu1gQDiWcI

  Score

  10^/10

  mysticredlinesmokeloadertaigabackdoorinfostealerpersistencestealertrojan

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1