Extracted

Extracted

• • Target

    NEAS.c9c5798e7a3d4bd33f48a62c21591a50d890d25d509aa359798720ea4ba3fb14.exe

  • Size

    1.4MB

  • MD5

    d7330b5bf5d11776b9e85f164ed4dbac

  • SHA1

    015c901c53b25b57dcc87b3717ee551bc8e20d77

  • SHA256

    c9c5798e7a3d4bd33f48a62c21591a50d890d25d509aa359798720ea4ba3fb14

  • SHA512

    b4298c4011a35302d7ead43d579244983ec644f41a012edf2264003e4faed2f17794853c4b17788ce4bac57bbd4dfa59736a09134819361742337cce7b783e4f

  • SSDEEP

    24576:vy4U3y8WzlCuqdxiatvvNgx9S7cceR3JYeLZk7dLdAgPe5shtj5uTmBeiz:64aazUuUiat3FwZ9vdkFOg/tluT+ei

  Score

  10^/10

  mysticprivateloaderredlineriseprotaigaevasioninfostealerloaderpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Enumerates VirtualBox registry keys

    evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1