healer

Sharing

Copy URL

Twitter E-mail

General

Target

8f1630bc8eac64cd06bd503a82b737a5f82d3a748f9021ad1d4babb30749eb84
Size

35.0MB
Sample

240524-r43blahf3v
MD5

3fe550d2a3448b98a1ef09fa5aa72a13
SHA1

1c5786c92e81fed3b8557f7c59069b655398d5bb
SHA256

8f1630bc8eac64cd06bd503a82b737a5f82d3a748f9021ad1d4babb30749eb84
SHA512

acfaab06381b9fea12e70313da09b4687b81e1727dece1834f390b57fa01002a7d2708ba154ee7dd996b68009992017e11ed8c5e37347f3d85d980a1c68d0ff3
SSDEEP

786432:WR9aEKSrFZmq+rcU0h6iltB6flxUiv9x8jZonjVq:WRn5/daF0h9SlvJq

Malware Config

Extracted

Family

redline

Botnet

murka

217.196.96.101:4132

Attributes

auth_value
878a0681ac6ad0e4eb10ef9db07abdd9

Extracted

Family

risepro

193.233.132.51

194.49.94.152

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

redline

45.15.156.142:33597

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Targets

- Target
  
  00081e34e876bca12f70718201cced140ead03a90881cda32a50f9f68a256cea
- Size
  
  479KB
- MD5
  
  2d229610ed018c93dfcc5b59645526e4
- SHA1
  
  945327efd2f65e5dbb047643a046993ec78edc36
- SHA256
  
  00081e34e876bca12f70718201cced140ead03a90881cda32a50f9f68a256cea
- SHA512
  
  6ae8f321f532d871dec8cfda37ebae8bfbd39dc5c559de7661ced18e5e4da91455f8ccc593e41f790a1bc1d34b28e0fa072ce89ea5ad931a2ed5eb820445e0c8
- SSDEEP
  
  12288:nMrny905lUb9c0bInz/hM4f2FX9Z/JkmyXHIH/6zN:wy4lUkdErCIH/6zN
Score

10^/10

healer redline murka dropper evasion infostealer persistence trojan
- Detects Healer an antivirus disabler dropper
- Healer
  Healer an antivirus disabler dropper.
  dropper healer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
behavioral1
- Target
  
  03c5b52913f2d935873e6576fc8246512a2381daa2ae332880d218afe379df29
- Size
  
  1.0MB
- MD5
  
  b552294e3e6467d2594b1e8926474b10
- SHA1
  
  4701c4b91f11ce28d256d29efe8d75a7f8c0ee52
- SHA256
  
  03c5b52913f2d935873e6576fc8246512a2381daa2ae332880d218afe379df29
- SHA512
  
  a7db60d0167a3706e4a456d2e635122fe6521c8a3165ae666e51db0373dd198bcf925fea18f4b81d3e4f07fb1a845e5b8df6fe37c8c6eb17b82af371b45c7a2f
- SSDEEP
  
  24576:/yWN0hJkMJp1nRz9i16oIg/wmFE4GUoFZmcPI7MRe3e:Khhemp9RxQ6a/9EfqT
Score

10^/10

mystic redline smokeloader grome backdoor evasion infostealer persistence stealer trojan
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral2
- Target
  
  119de5a5cbeeed307dc04cbf5ded4da088737541cdaebdb15683088ea4151d31
- Size
  
  1.6MB
- MD5
  
  c774c6f02c30ea7087a8aec8f106c4aa
- SHA1
  
  bc0e539a627d12e78b0be1d9dd467e9534d2b336
- SHA256
  
  119de5a5cbeeed307dc04cbf5ded4da088737541cdaebdb15683088ea4151d31
- SHA512
  
  424cd84746a0cbeed1e0843b310b4307231d9ad56b7d2023d91eb11849245121087509005480fd8af231c1a675132513de8e4478f32e8d37fc0250e30e71aabc
- SSDEEP
  
  49152:2XnOOAtaBjEDzERajpABSgwIGGi7VLlEF7:YIaBY09GGiBlEJ
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral3
- Target
  
  1d1b24f346602e2379272d189cb2e6e1b03f832a0f4cef4aa550aeda03407c2d
- Size
  
  1.9MB
- MD5
  
  15634bc356356836d1ad708c207d28b0
- SHA1
  
  053a164ecd4e758fa641a2d679bc410fc5e424eb
- SHA256
  
  1d1b24f346602e2379272d189cb2e6e1b03f832a0f4cef4aa550aeda03407c2d
- SHA512
  
  7252f11cb2e65e1daa76080dc12c5427b7fbb5b6ae3a09d77dacdf4bde4d1bed80c70fee060eb32b16946314df58f3f2660c6b3fde23dabec4ab3aeffc41b0cf
- SSDEEP
  
  49152:uE0IsdjOXgjEaZIEmmKwGvF2ZKzaAiLHOnwVoKhT74:aPjOXljN2Z4aAi3VoKhT74
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral4
- Target
  
  3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5
- Size
  
  1.7MB
- MD5
  
  5b7449e75139f9cc7488a0afc4c7e728
- SHA1
  
  a0c711b8e770060cf6ca185d70e7d6e4e6fc8c85
- SHA256
  
  3a50f05cf835b0751cd1bf42e4980ad9f9e3c83a3629331a0cdf1ed1240874e5
- SHA512
  
  7e3fe39782e1f1404aa4bcbf0ca3d5ba21a399c8045a61243a67eab538358c618262cb161eb9bde8bf8d9033b9e3c21b70d119b547f5f3bcabdfa16ee940a90a
- SSDEEP
  
  24576:0yaSTabSBeDdUlTbIQWIUezGVD7oy49pSrU0RCdSEWYBwa674GhsXnc1x9GhBayw:DxeiGsHBWIUezGVvHg00SdXOGetfayj
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral5
- Target
  
  47e26a3424119bb3474243a62c68d0c38747b303822e8e6d0198c8fc44796126
- Size
  
  515KB
- MD5
  
  f203dcc69457c4f08c89665d1998b068
- SHA1
  
  73cb4dc56ff1d6f5c03ff884266c758a5feb5acb
- SHA256
  
  47e26a3424119bb3474243a62c68d0c38747b303822e8e6d0198c8fc44796126
- SHA512
  
  60bc74a72e8210868efb5fb308c8e332a62c3e599e0602f94a1c84b23bdd10153248c000d7b60f4027af526ac71636a2b524568f4173b2459a34d4f7c496c166
- SSDEEP
  
  12288:0Mrdy905AKt2UKRMv1cBjTwm/dCR2XjDC8BRh6J:ZyEwUKRMvCzgsd4
Score

10^/10

mystic redline kukish infostealer persistence stealer
- Detect Mystic stealer payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral6
- Target
  
  5cb2e3146ea3274b3f079e836685e2606cf1e33338f3d1adfe019657232fa638
- Size
  
  880KB
- MD5
  
  cd2d434c0c751497d16291ea2d184d4d
- SHA1
  
  faf06f2ec5fd9633fbcf28bc6218da57d14b9f05
- SHA256
  
  5cb2e3146ea3274b3f079e836685e2606cf1e33338f3d1adfe019657232fa638
- SHA512
  
  eadfc92878c68021ba3623e388d19eaccee4d265bb9e945266b070afeccf06ad3c988d1e187bc079e8f5b7c05bc1ab3d71ee218d4e17a14d9a9962a1ac7ee63f
- SSDEEP
  
  12288:dMr4y905aVkPQUH7ae74IC5UpClHGghPLvXMXiYQODOc5tVbXrOtb8CXYca5UzSj:FywJH7aeUIsACtGcPYDtXOlEUzS7n
Score

10^/10

mystic paypal persistence phishing stealer
- Detect Mystic stealer payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- Executes dropped EXE
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Suspicious use of SetThreadContext
behavioral7
- Target
  
  5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6
- Size
  
  789KB
- MD5
  
  dde6cfec08e5464e53f006d24d683eae
- SHA1
  
  d2896ad8ed43f8543837ce46325977aef906b80a
- SHA256
  
  5f31ea5f4eff3ab14ef031f762f9d4bbea7989361e08a9f023d0687a4139f8b6
- SHA512
  
  d383ea9a8769c116c3546b4d8426a5c28512a6555dfdc73ea2ec5975dd79e74303806e2b8aed8d9e89a1ea42ea2d5651eb6b70c6fa90f08f6f8debac226062f2
- SSDEEP
  
  12288:xMr2y90HN8degBdF/RIqaSVJ3zQFo/DiK+BZhzSLU2qQCNQmhZNy/xUjDKMeT:Xyi8dTBd9baS7QW7lkzSFuCyy/9pT
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral8
- Target
  
  691f866dcf8672a185591df3654e1023bf55156531bb957ebf2d01b38adccd9a
- Size
  
  2.1MB
- MD5
  
  05c80653e766f73de20543840ebf7b42
- SHA1
  
  49be9e6966753bc0bac025865ba9fb26cae24868
- SHA256
  
  691f866dcf8672a185591df3654e1023bf55156531bb957ebf2d01b38adccd9a
- SHA512
  
  e936d56f981da024d85c2db4dbf21ed3f67cdc8d5f5731e293c29e825b71694ac88d5836a15d08ac0ca2e7fd5072c4d02948b7e8a8bae2d5a25cd3b9fe216dfe
- SSDEEP
  
  49152:GMkI+uzldOkxcga3FvuDUCXsBOtaw3omJtfL43P5ia:mupHvk+XsBO53omJtf4
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral9
- Target
  
  69d4397e3b55b04c8e1679751f0367e5ee1956dca9f17aa05804b89140026921
- Size
  
  1.2MB
- MD5
  
  f6399dc34708753580a9d5d6380248af
- SHA1
  
  04f968ebe55e924d0794245f1a5067d2bedc694d
- SHA256
  
  69d4397e3b55b04c8e1679751f0367e5ee1956dca9f17aa05804b89140026921
- SHA512
  
  027180ead80c1aa5eb60e6fa466c5c24dae7b2c60e3d46ea9ab37c7f896632bb09d15f729212fe3afdf2a022616867147e2038976589e46ad124a0ab13d81ba8
- SSDEEP
  
  24576:SymGYowx6+7PeBd43JtGDWW1Wzql6Q8yXUQ7/N+LSjILBasvS1d4:5J+7PeBuJ2WW1WzqlbzpOLm
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral10
- Target
  
  793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471
- Size
  
  2.1MB
- MD5
  
  4336fec8e2367a5e8ed47c3d26dd1ecf
- SHA1
  
  93b46fb26ae261c5efd54f1d06b8f6c7735ec467
- SHA256
  
  793977371c7b2f0c227ab38879d056d2d4121073f5f9a8204a60ac2f3238a471
- SHA512
  
  137126e026ddf41cabf315afe2f3816b7818dae25fa835a57b0f91c79f15be438a1cb81cb8be42be392c79a19298aa33b8a2db835befbf89f50c30516aac9d6f
- SSDEEP
  
  49152:fxRDQhHZCY16gX7duuUh94uZq7L+CISuSDodh2tJ:PEhHbNZOfZq7yTSkdh2
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral11
- Target
  
  823d46bb2009cf2d0669fdc864873d4184fbb02cc2836de9d352750179eec13e
- Size
  
  781KB
- MD5
  
  0c10c76a41a07f1fe704b9a7bc5e61aa
- SHA1
  
  ecf53f7d496d65ac8f5b111c6e225737ab923b9c
- SHA256
  
  823d46bb2009cf2d0669fdc864873d4184fbb02cc2836de9d352750179eec13e
- SHA512
  
  48efef7e7fa3d0962d440ab7b5e703dd95c8040d4f33c208d14b8562f9e7b5224888d105d09c0e8f7af488e172237d6bd0ed8dec57ed176dfe4c78c7156751bf
- SSDEEP
  
  12288:TMryy9050e3KMPyav6kJgaex4IC5KpCPHG9PPLvTMXiYQXDXYO9nt/QH5/3lTAMd:tyaiygaeuIsWC/GZLYDE9eRWg
Score

10^/10

mystic smokeloader backdoor paypal persistence phishing stealer trojan
- Detect Mystic stealer payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Suspicious use of SetThreadContext
behavioral12
- Target
  
  89cc8588fdd283d65796d258d20da78cc3e96dda70483c000ab1ff1232fa5562
- Size
  
  1.1MB
- MD5
  
  70af13c890c5081da2091516841af307
- SHA1
  
  594f38460e233676ee60e09a0e7bc6e0c4dd2428
- SHA256
  
  89cc8588fdd283d65796d258d20da78cc3e96dda70483c000ab1ff1232fa5562
- SHA512
  
  31104d94f244cb8ad36559f88ce9226733124cfa0db10d286c716c79794695f3e791e9e16622f8741c16c1b3982fd45bd9acf0390ea4cbb6f7f6d062ad73bd8d
- SSDEEP
  
  24576:CyNsrxUbbGlC5nHLNyoupccfuC7Px0riP+hniTx1Ej/N5bHFIo:pNskbNxyo3jGx0g+64zND
Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral13
- Target
  
  98c86667f1ebf054c7f37dbaadbc5346fa4eb658c90ca2b27f18fc9a73e1e23f
- Size
  
  2.1MB
- MD5
  
  a23220153436da05886658cec7072ab0
- SHA1
  
  1145db7aae4d5d886f6c8ccb3b6c47ebd567aace
- SHA256
  
  98c86667f1ebf054c7f37dbaadbc5346fa4eb658c90ca2b27f18fc9a73e1e23f
- SHA512
  
  1790f263ae4004c2992ca167dfdf4cdb9b4c141dbe252076f341e262e026eaf9829352a32d987fa5edf6789b026b0d23718ea4cf51b8aca0cb47173a2bad1797
- SSDEEP
  
  49152:ehsmLn/0BjK5GjdgJPssurZm1mdJ5N+f6QGfbXUjbINM+N6sjP7H9tsPb:+HwBZySz4mdJqiQGfbXfTjjH9tU
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral14
- Target
  
  9f2ebdaf308ea075223c735a2bda214b336c9e5b85e7eea51d6f701c535414d3
- Size
  
  2.6MB
- MD5
  
  43756e71f5bb80a4984e94b27d8438e6
- SHA1
  
  29615b5846d06ffcc54b13f63907489d2dd4ecff
- SHA256
  
  9f2ebdaf308ea075223c735a2bda214b336c9e5b85e7eea51d6f701c535414d3
- SHA512
  
  13dc0d8d37d34e14055a339b1e1d1bd5670c95b22cb009596277af06a6bb433c2cb234f293ea02f0fd26bc8e24fa844ac6931338a9f4e44d2df0f41aaa74c90b
- SSDEEP
  
  49152:BKzbEAAFqQqcn+nz2P8YVNwG70jeVdWC+3m2mtoAHjyQfF1MFUDgMKiJ:CcAbc+MEG78FC+2V6AHjyjUDgMzJ
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral15
- Target
  
  ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe
- Size
  
  2.1MB
- MD5
  
  9403aebfcf8861cf7aa95d5f4fe0742c
- SHA1
  
  9b43a3afca6601d0b37896d1e9df0d82862ecbcf
- SHA256
  
  ad2c12e934ce4a8c4fdd4abf52a21352a8456bc150312c8642d1528f0b44ebbe
- SHA512
  
  d50f92534d58566353ba1986f79fa39c922f682a1f7846523327fe97400cd80bdd34920a8ccfb336237875743c2a3f0a0782184a76c3c12613826d4d64483787
- SSDEEP
  
  49152:kEVelgb2QALKLgGvYUuP0qINJA+GxZITESaTGq:Ogbq9jMLzA+GLITESa5
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral16
- Target
  
  c07f7b11efb87573ed231edeeb982fc58c253f72387321ec3736463e6ea4a7de
- Size
  
  2.1MB
- MD5
  
  20ff175f8720527af8447dc2b554cd25
- SHA1
  
  45367572c77057462aff7fcdb549fe706955f12c
- SHA256
  
  c07f7b11efb87573ed231edeeb982fc58c253f72387321ec3736463e6ea4a7de
- SHA512
  
  78421335fb868ed406013b10da27b26b3814e3d59900db22d511efd25179f571726bf39fb9bacd02fcab5944343262a2d00f52787122c60fa896c3fce469ba63
- SSDEEP
  
  49152:+qrAEXJn/KSLpgYIomud5MPKLUrTMr4JeklWpc2rXB39acsFeV6Orpsm5ky:7l1+mYKOMriAc2rXBh6eVem5k
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral17
- Target
  
  c2b30074415b46d19f46cfb5af14cc647a982661dec4c01c99d01c052a77bc41
- Size
  
  1.7MB
- MD5
  
  a51d9c958bdb47a0ad654c99f0229b7c
- SHA1
  
  d5a344b851e085181615cba6ae90a56892272f58
- SHA256
  
  c2b30074415b46d19f46cfb5af14cc647a982661dec4c01c99d01c052a77bc41
- SHA512
  
  54c49b90ec1f06e926caa244e59297feb418947b34416355b72aecf34e82fe5a69362f91d5165131dc0bc758d8fec788442867d1131de9ddfa8043c78b2f8bcd
- SSDEEP
  
  49152:B5Kgm1Ta7znTWyNTnQoO8LMWOkB+vrfDj/nDUiC:Dpp9OP8BorfDj/ng
Score

10^/10

privateloader risepro smokeloader backdoor paypal loader persistence phishing stealer trojan
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Drops file in System32 directory
behavioral18
- Target
  
  c2c2bc25ff713469ab99ce4873da4568ff91920dd5f18365b0bccc99f89f52d6
- Size
  
  274KB
- MD5
  
  3ba9be3d2fe5f062e851a8335aa0d915
- SHA1
  
  2d07663296d6c6a02f35cea6f68ae76610c5d1ad
- SHA256
  
  c2c2bc25ff713469ab99ce4873da4568ff91920dd5f18365b0bccc99f89f52d6
- SHA512
  
  3021c87f5b7db7de11588a39f4c478bf09ca72aa08f4092cad768ef13d3afa6ff33efc3ec1492efe1eccf152893fc4c42001c1b9d9f20887ab92623ea87496f8
- SSDEEP
  
  3072:v+6UQwD64ZrOcHDP5oGjG/rHgoHNxyRVoKKdwS5kiqD3FWoz5g3WiliiJ/+uXK50:1UPG4r1o/RLseYn5g3WiLfiTi
Score

10^/10

redline infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
behavioral19 behavioral20
- Target
  
  c8ec96893956dfddde7afe6387866ad1e9246e552dd28a3b5af097fc3b5ced44
- Size
  
  1.7MB
- MD5
  
  4cf976c47acc760a9306b9f6f4c071f8
- SHA1
  
  b1dacfc53ec0c1344e321b2df52d6d711c3090e3
- SHA256
  
  c8ec96893956dfddde7afe6387866ad1e9246e552dd28a3b5af097fc3b5ced44
- SHA512
  
  5b1eb407ce8c66908ea4095d04a1b9707fb66ac2635982ab7f9e9e283d3cbcc2fe78189917ab427e4bb1b6f9a641f6715a204252fe51a70c6c866509e65ebf2b
- SSDEEP
  
  49152:swZQsWvUwzinH9gV+JJb2RmsK4FWv4Vf:NIsu+PtYMS
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral21
- Target
  
  cfdd1984803e69136f3df9a29df5f12b0e779369443871fd786a34fa68317ec6
- Size
  
  1.5MB
- MD5
  
  cb25b6bd54c4239ad5a75fc6fee281d1
- SHA1
  
  ed46e5bebb879516910f09870ebe26bdaa47f23e
- SHA256
  
  cfdd1984803e69136f3df9a29df5f12b0e779369443871fd786a34fa68317ec6
- SHA512
  
  76928cafffca0716011b44fc29951efb9136b0264b48bf8cf690310244c88de7dc8249e38eba7a89abfa56055e74c09ffffbb463e30cd902ef6467395d79ec47
- SSDEEP
  
  24576:SyCKD/kGZQfbnV3frc9jFJcSKUqH8wIJjKHgjp6o9UMDJyudYfoxil:5NQDnVARFJIdcwu2gYomMDJyuOfOi
Score

10^/10

privateloader risepro paypal loader persistence phishing stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Drops file in System32 directory
behavioral22
- Target
  
  e74ebb8467d5d586d2a4f3c223c158072e53cabf7285466f9a7ad66a30412d40
- Size
  
  1.2MB
- MD5
  
  3b559b26726f576f04e78e9a25cee2ea
- SHA1
  
  0422d553e4603b37d4a0d8d667fb4fe05fe4ba1b
- SHA256
  
  e74ebb8467d5d586d2a4f3c223c158072e53cabf7285466f9a7ad66a30412d40
- SHA512
  
  0aca341171ed46c20bd2e028e3cb7029a65ae7910bfd4beba69eefa315fb0ccff80f9e9c376f35e653022c419886867013ad54bb046f60c6983025cdb3d4d39d
- SSDEEP
  
  24576:pyomUctd4MXULIMacWl1KzNe+3vyXf1dXPWbzxW6TCEz6p9:coOtdX43Wl1KzNeabn8
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral23
- Target
  
  e7cf07de33635cc163ae13ce8b8adfe9ec1289ef2a77d4635c1b02bd7bd80aa0
- Size
  
  2.1MB
- MD5
  
  9db1eb824fcbb2d3a8896e726f5c5e0d
- SHA1
  
  fcbcfe8421977a86bb88f0b8b95727bc1afb1f8a
- SHA256
  
  e7cf07de33635cc163ae13ce8b8adfe9ec1289ef2a77d4635c1b02bd7bd80aa0
- SHA512
  
  f5d426c9060336d5b9ae4bbf11155e712ea7ceb96b52c3974c3c89f2db900782eefc2692d6033a99a19c18407e005d796acdccbc0fd7a261d7248ca182d1428b
- SSDEEP
  
  49152:yvEhs2vWs2I/tgLiDhu8T56Ps2V+nW5Na5adCRRf3OPTj0:ps6lO0d65tM5VRmP
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral24
- Target
  
  e8089d289872dff0d032ef9544f3019d0bb5fcff11996290619e1de6d78c7c9f
- Size
  
  1.2MB
- MD5
  
  e6801fc47ae8b20cda4d61811bb4e7ce
- SHA1
  
  ea56fb30485b1ad8997bd817391c3b5bf9ca3cdd
- SHA256
  
  e8089d289872dff0d032ef9544f3019d0bb5fcff11996290619e1de6d78c7c9f
- SHA512
  
  59c6785771fa852107b95613aad6e0497d2821b93d7321b5564279a1a6c5c53d53db3c43ee6bd5f2b2ce0d292a7dc2ac765582501cf097c7be8cffd7d8cd161c
- SSDEEP
  
  24576:Z6ytqGCld4xfCNQWd1Yzgp888yXADP47ksJ9oClbcdr7fAS:vtqRIhWd1YzgpHYDjsPfCr7
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral25
- Target
  
  f298002951f275351953751a44b736ad2cdb679a2cd29bda1f4f65facb4944fc
- Size
  
  203KB
- MD5
  
  dbf536a0a627a3ecda4cb12d660e8323
- SHA1
  
  0a2c1aab2ce457f181402ae0e4294eed7135c779
- SHA256
  
  f298002951f275351953751a44b736ad2cdb679a2cd29bda1f4f65facb4944fc
- SHA512
  
  25cca78b1206b5c903affef415ec2c204a605f205788bcf7dc638fd97e332a86a09da03e152cd877f3b09e7287f8a03cf128eae92329063b72c7dc1d0954069a
- SSDEEP
  
  3072:j5ZoszxjoIyV+HkUHFrt0KtcQ40J7eD7t7PQTpzJ4c:j0itEUHFrt1t+D7tbQTpzj
Score

10^/10

redline infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
behavioral26 behavioral27
- Target
  
  f9420469aa3326f8f0142d01cbe53363a015e3579644b84fcce388b71edb614f
- Size
  
  1.0MB
- MD5
  
  8219c91ff157d34ad13e9eaaca1ff3d0
- SHA1
  
  1ef89eb62e086d504b80795557ac9e42686a9d28
- SHA256
  
  f9420469aa3326f8f0142d01cbe53363a015e3579644b84fcce388b71edb614f
- SHA512
  
  d01862cedd90ade8eb621e73e2bbc1eeb7a937b0c7f7d288422f32a83afcf8ba832b6554aefb8aee40d43597cd8721750c470e1d59926f7bb03d7539a416caf1
- SSDEEP
  
  24576:Cy6yVCA/5fXKw6PEZ9jSvWMLsfUAUgcsbb/ZYGtrSmzFgiHa:p6yfBfXKVPEfSv22Ps+s7z2i
Score

10^/10

mystic redline smokeloader grome backdoor evasion infostealer persistence stealer trojan
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral28

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Detects Healer an antivirus disabler dropper

Modifies Windows Defender Real-time Protection settings

RedLine

RedLine payload

Executes dropped EXE

Windows security modification

Adds Run key to start application

Detect Mystic stealer payload

Modifies Windows Defender Real-time Protection settings

Mystic

RedLine

RedLine payload

SmokeLoader

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Detect Mystic stealer payload

Mystic

RedLine

RedLine payload

Executes dropped EXE

Adds Run key to start application

Detect Mystic stealer payload

Mystic

Executes dropped EXE

Adds Run key to start application

AutoIT Executable

Detected potential entity reuse from brand paypal.

Suspicious use of SetThreadContext

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Detect Mystic stealer payload

Mystic