Extracted

• • Target

    NEAS.8e658be1287f69327c68a575863888918e1ca90e2bd09247170a81af6b3cd34b.exe

  • Size

    881KB

  • MD5

    03a197cb40408aac6618e7053cfeab39

  • SHA1

    b8a29bad9f6b58446e9b893915eb1257c491d25b

  • SHA256

    8e658be1287f69327c68a575863888918e1ca90e2bd09247170a81af6b3cd34b

  • SHA512

    77996add4dc1640c103d950a98f2b9af8d73b39c20af7a6a8c704452dfcc850f1e1fe3db4776ca7a5de46ade05c957c5836f1c7f639f982776b668b87908d4bf

  • SSDEEP

    12288:bMr4y90FsqzLwuxgjDc9/0SsepUKwUhOa2oCh08Ul1rsiLBziv0KTHJYJKfdpuij:LyCzsuKj49wKrhT2bpPuKDOJKHuc

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencespywarestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1