Extracted

Extracted

• • Target

    a4cr.exe

  • Size

    271KB

  • MD5

    f95895e7becbfed7b5808b190cc58bf5

  • SHA1

    76fc5f5e1bfd00695413c07835334aa097881017

  • SHA256

    a1ccb714dc5a49c230ecf1b86239f9983024777d3ae1dbd42971b93fba4036e4

  • SHA512

    4998457db76802ff24f31037809d286d4bb7a9feb4318d579f48ea8041c333a5a16037ba4687889bf0bda512718bf1c143c142c65220446b50dd8c18ff1d016e

  • SSDEEP

    3072:FTLr+scTWSq02XceKBuO8888gV+PUtbtKTUX8pFxtpSQ2v/D:FiscT7DqVKBuO8888gV+zt7HK/D

  Score

  10^/10

  redlinea4infostealerspywarelaplasstealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with two variants written in Golang and C#.

    stealerlaplas

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2