Extracted

Extracted

• • Target

    0f66c11b84b409c0b2ea602dc96585f2.exe

  • Size

    953KB

  • MD5

    0f66c11b84b409c0b2ea602dc96585f2

  • SHA1

    d96d7df17a0738060d4ddb10d50d60de5db79e02

  • SHA256

    ed9c56af756bffebc97edfe6ae977c42e77f5bdaeededc4a9b46186578ecdc34

  • SHA512

    aea094b27902a98c26ddef881356ae5498e83036eb05fa169b04efdb3d762f16b220523ca71994ecd5fbfd1d020f96b934f9027ae227e8c725ebc1f50d3b93b3

  • SSDEEP

    24576:AyGNQR5BuiZHHXPWFVS252rjBGS8Y5v69Nw2:HUm0iNXPCV6ISy9Nw

  Score

  10^/10

  privateloaderredlineriseprohordainfostealerloaderpersistencestealer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1