Extracted

• • Target

    NEAS.9af7358979fd621cf352016fb15e5bc0.exe

  • Size

    917KB

  • MD5

    9af7358979fd621cf352016fb15e5bc0

  • SHA1

    4aef20d5c4704d8ab3defe5203a92b1aa2d790ba

  • SHA256

    cf09565fd33a74ca430aa23ecfeab197d1a2ba498577f7b8c08daba846ce34cd

  • SHA512

    40b5f086074d8cc362dc8d1e80a9fc5ff8bb0eae074e7d2b47df83d49eafcad9092ef8634b9ccee653122e9c874cac58661e03749fb54df26620a1de6636a1e0

  • SSDEEP

    12288:8MrOy90utPPj0GnUMm0NldH2laex4IC5ipCPHGkiPLvTMXiYQ5DRwAyBxhwumJEJ:qyZX4NMV5AaeuIseC/GRLYDPqnEix4

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1