Extracted

Extracted

Extracted

• • Target

    NEAS.b5b6dfb221365b25f9343b8b1f7d5779eaa1cb489a15508852d5f9227a6a91de.exe

  • Size

    1.0MB

  • MD5

    c5b1754a5a0a883c4a9f15c3abdac46a

  • SHA1

    644d28d5fe0c4f90b6e266c26114ccf6a83704c1

  • SHA256

    b5b6dfb221365b25f9343b8b1f7d5779eaa1cb489a15508852d5f9227a6a91de

  • SHA512

    1000dd7a47591b24eda038b208153745b0341b341b5fb0ee206a71384d938613e344a0da918a832a30ba6bd78617598c9f15875bf79eabc7e69e7a8a61a5a866

  • SSDEEP

    24576:hyAqcU9+cxq3aeBIsKCyGO4SDPnIpjFDhkj4HgF:UakLe6z9Gq0pBVkjA

  Score

  10^/10

  mysticredlinesmokeloaderzgrattaigaup3backdoorinfostealerpersistenceratstealerthemidatrojanupx

  • Detect Mystic stealer payload

  • Detect ZGRat V1

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1