Extracted

• • Target

    NEAS.7d4a69c65851eed92bb3c18a3cbbfa90.exe

  • Size

    426KB

  • MD5

    7d4a69c65851eed92bb3c18a3cbbfa90

  • SHA1

    2b96b4ca11b46405aaf634748b97168b67c1fcf8

  • SHA256

    780c385a4a0971c375f65da31bde5d3c8b23426ce0f26b6401152786e23650ec

  • SHA512

    4906a495b42d6671ddc28b284e5edf9be63a2e111985e48a9d07b7db4e8b8bf3b32f6a056dfbbf34749ba77836c21381a9b37a3a8b535c85a0927a31f16a8df2

  • SSDEEP

    12288:rMrdy90QqOmVfjoTadA37OhbpmPZZ5/Yja2e:CytRmVfjoTadAL+piZXgj0

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1