Extracted

Extracted

• • Target

    Installer.exe

  • Size

    1.2MB

  • MD5

    d017c52a55cb3741adfb83eed1d6f052

  • SHA1

    fe3e79ad0cb2b2e5374dca688c83de93ebba9bb3

  • SHA256

    aa8a2e7e1556276dad50729a039ac5cc81cd16494ecb4431f8d6ad59fa8eb9ec

  • SHA512

    d207b117dc24f856d7ba385d4764f724940a59d1f56a3fd2abaf267e1dbc47234bc5cfce2765ac91b501fcd0925048bb22acc1f050e2c9c36c483581c2e1598d

  • SSDEEP

    12288:dGKA3PekjU4fQHp4v8Q9SWVPs+ihQq/3C:dI3gNGUQcWVPBi6q/

  Score

  10^/10

  redline@merchdinfostealerlaplaslobshotbackdoorclipperpersistencespywarestealer

  • Detects Lobshot family

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Lobshot

    Lobshot is a backdoor module written in c++.

    backdoorlobshot

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2