Extracted

• • Target

    NEAS.eca9b6f977d54b1c080b2457ca6c6390.exe

  • Size

    768KB

  • MD5

    eca9b6f977d54b1c080b2457ca6c6390

  • SHA1

    e6528636fd826b4181bc0b1a203837853d6faf7b

  • SHA256

    1f8f2e9e28f50f64ea2b24fed246c89072904096e4bc15a3595013e3b34c7867

  • SHA512

    2d2defa7e29cde5e66f4721fcd9e376413a304469eb270c432c51e483912eaa6b898a0d2bd35c68258d3ea16aeb7a01a93e5ae33647be8abe4e3f1c1ca2321a9

  • SSDEEP

    12288:KMrvy90WGL1MbXI/tgCdgmL6+I3JPYzxJTZkBvu2kvVc+c/QaOq1ywz2HEmZZ7:VyxGuY1gug5+8JPKJy9oVGlywVWZ7

  Score

  10^/10

  mysticredlinekinzainfostealerpersistencestealer

  • Detect Mystic stealer payload

  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1