Extracted

• • Target

    NEAS.f254b436b94b988732d2dc398f365270.exe

  • Size

    379KB

  • MD5

    f254b436b94b988732d2dc398f365270

  • SHA1

    e3f0ef723e8cfd9e023120c2f3d7f80faa256a8b

  • SHA256

    c73495ac15edf243436755d8956653e0beb40278879b02b57909e6ed4003158b

  • SHA512

    9468f200c29e854c15703c45990654eb77f3f3a73af34f9a6691c7399aab892f796eb6f10342b8b078a0f906db66a0a25c5bb5d3e12457b730418fe15c7aef82

  • SSDEEP

    6144:K6y+bnr+fp0yN90QEpmyGN/8wUGvYo8B6194oQWnD6ykQD7tStzpsZEdOXFJmHvg:WMr3y90DSRv38FhwLkQDp+sEQVJmHvg

  Score

  10^/10

  mysticredlineluateinfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1