Extracted

Extracted

• • Target

    74b888bdab7e6891ab939281d25ad81dba0d66c7ba6961cd6fb80b547941ef8e

  • Size

    1.3MB

  • MD5

    22e33ded1dddd3c2c0044626713aee1a

  • SHA1

    cb600f72edac4e644079d34f73d70814772669d6

  • SHA256

    74b888bdab7e6891ab939281d25ad81dba0d66c7ba6961cd6fb80b547941ef8e

  • SHA512

    13d5e8dfaf7068928084a31ba6e9ccd80dfd27900f12388a6e644d3851c67808b06d71f03af6a3d16be5eccd6cb39b2fb1e9037582f7af9acd3b92d19956b8d6

  • SSDEEP

    24576:Dy6iASsz43r3uCbrZ6Q5ymp7q/FbvG+DxMhzxLYr:W6SskLuoZ6Q5xpUao2

  Score

  10^/10

  privateloaderredlineriseprohordainfostealerloaderpersistencestealer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1