Extracted

Extracted

Extracted

• • Target

    6fb6cfdca040bd1e7ab1256d37306416.exe

  • Size

    741KB

  • MD5

    6fb6cfdca040bd1e7ab1256d37306416

  • SHA1

    f9f8270d2186a27a3f7301e4e3d3cccc73bab0ad

  • SHA256

    0e59fafb2de30f5fa5b6cce425f40115180b373592e1a201702742a6e8f21cc9

  • SHA512

    0e4c654863528e97d67741734217d37d0cec03d9bf9cbe9e66543e614566d9e163c5b8455548352b56a706225937bbc5dc17c5c9a8e52e99637b6885ef2d0ad3

  • SSDEEP

    6144:25G0py2KhkpK60W2VuTLx7AV35pDNvB/PQs6AvLTJ:25M2KhkpWWYuHxU3pDNvB/PHXLTJ

  Score

  10^/10

  redline1infostealerspywarelaplasclipperpersistencestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2