Extracted

• • Target

    NEAS.69cc3fc1b2b999869a538520c5e0c680.exe

  • Size

    877KB

  • MD5

    69cc3fc1b2b999869a538520c5e0c680

  • SHA1

    5f0838369a2acd8c07cb658c000e3d2e2eeb54dc

  • SHA256

    25529128be4a0de312d15794c203ffaf719fa816bb80daf43aa2680f3657e9bc

  • SHA512

    a276fca5bef5ed2d1a818576fcfc4a231d9d83df19d17ab847bfd8afd49e1cb46bfb0cc586ed2554f04d51a2237313c6483299d85c43f1eef3249e68a53019ff

  • SSDEEP

    12288:qMrGy90V9RaKRbm+ae74IC5QpClHGurPLvXMXiYQ+DkSrCgoEK6WDuFR1xv7DH6:Ay+lxm+aeUIsMCtGmPYDUECDKRv7T6A

  Score

  10^/10

  mysticredlinetaigapaypalinfostealerpersistencephishingstealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Detected potential entity reuse from brand paypal.

    phishingpaypal

  • Suspicious use of SetThreadContext

  behavioral1