Extracted

Extracted

• • Target

    090c4eb59520db21f5922ad7ea268e8b.exe

  • Size

    1.1MB

  • MD5

    090c4eb59520db21f5922ad7ea268e8b

  • SHA1

    16e0da553155e1f7ecbec7ed237345d83c2039ee

  • SHA256

    4dd3c6a807bc550a92e9b2686ec8891d7db25ce92472e4b0ad57d69f7d81eafd

  • SHA512

    4843a3c663cb3f5c6d294653b3e3050819dbd051289507cf05326eb696189051fbf0a9106cb13bbb69d43fdabb9df59c01c9aec9c4d78d012859ce770ae70f7b

  • SSDEEP

    24576:+yGcqTFND9xirfCV9P2JHHfNeWelqA95:NGhTTpQfCnPllqI

  Score

  10^/10

  privateloaderredlineriseprohordainfostealerloaderpersistencestealer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1