Extracted

• • Target

    NEAS.d57c570e6aa9b0c20fdbeb08c0cbf750.exe

  • Size

    892KB

  • MD5

    d57c570e6aa9b0c20fdbeb08c0cbf750

  • SHA1

    71be60159d0fb44ccc88d3562f1c575fadf486fd

  • SHA256

    ca6fb1056ad147526c05d64ff88ef7d6b904c5d1e70eca73dfc446ef3c6586d0

  • SHA512

    9b42d68bf80329af9d7cd5c3d66128035e0fa7fc3dda5d614a88a74dab0a47dceff06be684b37d696121a3ff7f48b6d7b4e362fa37516ebd5649c57ca71a6424

  • SSDEEP

    24576:hyNxCHPsDCH4Kxumk3y+B69hVOjT+TeLPpoJYLh:UNxSPssvEaOjaTe7poJYL

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1