Extracted

Extracted

• • Target

    ceb1aa6e9ab85da0c17ef0a80324217447a39a1f1367751848febc763ee06c41

  • Size

    1.3MB

  • MD5

    be19ecb8d19b15fb5d3ea529d27d6fb6

  • SHA1

    688ff79118fdf55481eef298e0196b9a00ed7438

  • SHA256

    ceb1aa6e9ab85da0c17ef0a80324217447a39a1f1367751848febc763ee06c41

  • SHA512

    c7ad5b829227f2b18ff1a5cf1b85bb9bf76906d2444caa1d2139e2fc0cf44e3259e09fa8746b07602a018bc39544027ddcf72901a0a65c62b896b370506b7fa1

  • SSDEEP

    24576:EyzJYgjVz7HlCpn276v9e3+agbxXyLZhVI40CTgN3E3bDhusy:TzCeFjlk03+a8JyNhacrD

  Score

  10^/10

  privateloaderredlineriseprohordainfostealerloaderpersistencestealer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1