Extracted

• • Target

    NEAS.a88a701b705403da1eaa3d48a64e5460.exe

  • Size

    917KB

  • MD5

    a88a701b705403da1eaa3d48a64e5460

  • SHA1

    6aacc2a7e8418a60b7ddd3dc7ed2b0e7a460f70b

  • SHA256

    0e0b9f17babbcc238682cad73343bb06df3b67e94921ec42e533d02ab056c2fc

  • SHA512

    2afb5ad2d012cd81f4c2fd7a80c547496e22e6c763ab6ce6c01bb498fe151b7f5239a42d11531529e2b5a99803fcc5bc15158b3492ef57542769aa10bb84ba67

  • SSDEEP

    12288:rMrTy90c5KFDGZ4ozMaex4IC5ipCPHGBLPLvTMXiYQTDLqeUePNYGEWkiFV5wGhh:gyV5KFikaeuIseC/GZLYDSaZ8V5Jb

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1