Extracted

Extracted

• • Target

    57bde0040690dbc1a57bb3985b51fb20f52252d52d961f915ce1a8538241f7d8

  • Size

    1.1MB

  • MD5

    f053475d8ce8b045850ff8ce2323709b

  • SHA1

    de476080cceb5d39ee1d15a5abc7d504489130d8

  • SHA256

    57bde0040690dbc1a57bb3985b51fb20f52252d52d961f915ce1a8538241f7d8

  • SHA512

    6f634ca4951f29a5d98a138ff0d380d94b4268150d6b2568f87943a537245432ab9f8f87aa151a7a759750d6a2647e8806f80e1910cee9d8cbc6307590c4d950

  • SSDEEP

    24576:LyylLobAGReV6CQ7t6gw2Svv/3ehqayTGQ8dceN7XT27RxN1mS/:+ylTV6COBzSPCqaVv23z

  Score

  10^/10

  privateloaderredlineriseprohordainfostealerloaderpersistencestealer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1