Extracted

Extracted

• • Target

    6e349cf64aa3fa330d1312bbdf0a158376282fd547c54fcabf75af777d93ae40

  • Size

    1.3MB

  • MD5

    75164be06c9b8c73806036ab715788ec

  • SHA1

    c13cf0913187995099d905514132bff25499117f

  • SHA256

    6e349cf64aa3fa330d1312bbdf0a158376282fd547c54fcabf75af777d93ae40

  • SHA512

    57dab7a3b4fe0a0a0f03fd89963255d7cdd50357466d8976a2cf2b01a199cf7398885f03b61b16b2a6803d7ae4adf29b3077f3c59501b16abfb5c2a32f2215bc

  • SSDEEP

    24576:dysip47L/FL4zSGxulRZxDUodeuUUmZyc0yC9EOGSGeQVLACeswSp8j8jFRu:4sip4vF4zS4uv7DzdNwiyERGe0Acp8jQ

  Score

  10^/10

  privateloaderredlineriseprohordainfostealerloaderpersistencestealer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1