Extracted

• • Target

    NEAS.6e77e22e56cbcb7269523e93e9949070.exe

  • Size

    993KB

  • MD5

    6e77e22e56cbcb7269523e93e9949070

  • SHA1

    1d6ce6a4ef10582fcf04bfe6bf2300753f7904d9

  • SHA256

    fa7fa14bbd3670a790b74ceaaf028458b09ff61fa4e0e5eecba146f832890899

  • SHA512

    ee2a57beba13498639b7d299eddad32102403b0c4c6bfc2efcf8c0c7aed94131dbb112b106c323a8853129b6910b7ea39dbf41c27ef09a70a4a7f4faf80e61c8

  • SSDEEP

    12288:DtMrey90jsjVw6Vm2In7+jwHizVZYeO/tyJOViFRHgoTEC+/SxU9K30dbW7LkC9G:DnyyznhiBGR/xQDHg1bKwk59G6twrc6

  Score

  10^/10

  mysticredlinelarekinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1