Extracted

• • Target

    NEAS.ee27277c6bf289e382e2f5cc43485620.exe

  • Size

    511KB

  • MD5

    ee27277c6bf289e382e2f5cc43485620

  • SHA1

    4b939462cca31e2067b56914ac69e163eef59708

  • SHA256

    56ee0b13200e4a07e7fb27ab37f71306d5b6a5b4e8db9fc5acd7dc0adb3ec8d4

  • SHA512

    51a5dc338df140e3449d397e4f578ce33206459472ce942dc9f595db8c6019d8e1670f06f8dce509dbdd427e6d257621a9ccb52784ffb6bec28602f3951323da

  • SSDEEP

    12288:DMrjy90NmXaLLY8TUs2kuT+4+wSRxFRR6RKK:YyWmXaPYSz2ku6USDPYB

  Score

  10^/10

  mysticredlinetaigainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1