amadey

Sharing

Copy URL Twitter E-mail

General

Target
5eb722b1af29eaaa64b029ffc54dddae92acbb9c1b778b6bc51551329ed241e8
Size 30.5MB
Sample240524-sd1kraac64
SHA256 5eb722b1af29eaaa64b029ffc54dddae92acbb9c1b778b6bc51551329ed241e8
MD5 8c65780877dcee2eeb50f5424c999e7a
SHA1 c87aaa0d426c64b2996ef2caba1f61c67fce7a05
SHA512 34941a6c84ad908f79fe2cdf4bc1455ba2462230a952fdd12fa3b6e37c62ea0aaf4ce4326d1a568604e686024df5016c72e7031014c8a62adb6d9bc48fd10ccf
SSDEEP 786432:pYawNE5N0WMw1obq/GCoLxW6OSFy6zlPes6TfjM4M8:plwNEVPHn6Oiy6URLjDM8
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

risepro

193.233.132.51
194.49.94.152

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

redline

Botnet

plost

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

Botnet

04d170

http://77.91.124.1

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f
url_paths
/theme/index.php

rc4.plain

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Extracted

Family

redline

Botnet

lutyr

77.91.124.55:19071

Extracted

Family

mystic

http://5.42.92.211/

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Targets

- Target
  0eb0accf09d83ec290b068c81be5e6c35e15cd72f8c10f74ea2ed429b7fcc8b2
- Size 2.2MB
- SHA256 0eb0accf09d83ec290b068c81be5e6c35e15cd72f8c10f74ea2ed429b7fcc8b2
- MD5 b4c3f77e4969034efe656de8074b807a
- SHA1 69f25a7302e9136a6cabddaf887400da77396cbd
- SHA512 03f82abda501ed46c71c4f30f42b8f5da1c786af2335109ffcf6143b2738ce54b65f0114866c33ce983f15e2db50db01938a1484b9f2c123cd30f69efa61ad33
- SSDEEP 49152:rl+1gFaedI3UP14VGoijicHYgZLsKNYtSxRY4jMIvPM+:2wI3UdaxGD4SxRBtPM
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1
- Target
  24941336d0128a7ae974066981d3a1f75cc9af91a69a49b292688943f69afa72
- Size 1.0MB
- SHA256 24941336d0128a7ae974066981d3a1f75cc9af91a69a49b292688943f69afa72
- MD5 bb9900689940b2154b9b395fce9ad47b
- SHA1 79d1ae33512de00466f9d94ad218c14db69aaea8
- SHA512 c1dd079b33cb55034d77baf46a34710ad737c5c59796b2394c252749e937e1039e5a82f79afd805d019f29647b726bb46a295231bd6142f5cfb24facd625e52b
- SSDEEP 24576:9yeBW5OU02BlbIchjvrU//0Zsfi0EJ3uiS2sTRqJ:YeBbCscBw/4sq0EJ3uiSh
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral2
- Target
  26a2cda7a1e823b15014df6457ead29cc24ca1e9d7348e5f7ce65fac3e640998
- Size 1.3MB
- SHA256 26a2cda7a1e823b15014df6457ead29cc24ca1e9d7348e5f7ce65fac3e640998
- MD5 86cbb67c990eec1b056fb82f113bebbf
- SHA1 dc1ffa43dc573d580c698f8a350f33fbb7704a93
- SHA512 9f0752b57f62dd6f397c24c92d9efa143e603e10347f6114fbf41cfdeed0906f88eef1d6a8cdbcd88ca6e2e0c7b91ab6d897ca89830c4ff1ececaaf0df05e249
- SSDEEP 24576:cyY2jqXwFqvrXZsVeppEX0tywAQWg+UZGfRhwcLXvRMKUPR:LxjqXwirSWY0tymRGdXpMLP
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3
- Target
  29d3a95944732180e7b649fa96bb2f15636a9658a83828117964eea5a39c72db
- Size 1.1MB
- SHA256 29d3a95944732180e7b649fa96bb2f15636a9658a83828117964eea5a39c72db
- MD5 65f3094287ecabb93243414da30c83fb
- SHA1 618b22115bae825725f7e9544060ab66ac1a889b
- SHA512 deb98c2947fd3a84cd4461c712394c00ebbaf5317c3969bcc3fcd8ffda4d58dc78b24992dc9f0d933302a57937d1cdc84749fa55f311ed3ca6ed6a29bc7c406f
- SSDEEP 24576:JyIlMs03q2/LvDsuZTe+tCbubF+KSSguGnS:8yMarCTgSbZ3x
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

mystic redline lutyr infostealer persistence stealer
- Detect Mystic stealer payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral4
- Target
  2d75908c0774dcb3f45e676b4c83554e0c2c94a1e96fd64e163484e0dbbf359b
- Size 1.5MB
- SHA256 2d75908c0774dcb3f45e676b4c83554e0c2c94a1e96fd64e163484e0dbbf359b
- MD5 c8ac1db7f2f53e0694220cb03abc8272
- SHA1 b4cdc41ef7aea4375f230bd070b1a10e2dcac88a
- SHA512 62ce61598936aebbc62fa07e1b361658156e30a27960b1f61f0a595a4548ea1d4c03c1135433c37a24bc7fa1c2d64434be8dc0c5600c796bdfd4f3093490f75b
- SSDEEP 24576:8yDJ1g7XSiYHKHSZWbh7cwf+iGDJtYt4WjLfGxeVFlmjURMjxbkr1sibIkx:rDJe7XS/KHcWFAwf6DJtY5L+xeVFzMjN
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

mystic redline kukish infostealer persistence stealer
- Detect Mystic stealer payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral5
- Target
  33aed805e114f04f73f867fdb7cf904e15447aa47f74e094c024c9b18c217fe6
- Size 2.3MB
- SHA256 33aed805e114f04f73f867fdb7cf904e15447aa47f74e094c024c9b18c217fe6
- MD5 c3d5c7226492ba7e93bbd9ad9276d679
- SHA1 f10dc42f76340c27d7c11324f2906ebc8dafcacb
- SHA512 b469ab72e1f552476d4f1c4fa99a6084677e064ffa00e675083fdb35cb835d107729fb3b5143dd54b1aca11a3fea406d5704de3ae2c755d886c557e1a38329cf
- SSDEEP 49152:EzrKxn0THgvqeQre2p7A9TwDMxoZnsrcsGuRA:ue1egiDemMGMxcZm
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral6
- Target
  40d8e0aa1d01acecacb5b454de82773c5a4b5f13ec3abf8ee0ce0c906690a918
- Size 903KB
- SHA256 40d8e0aa1d01acecacb5b454de82773c5a4b5f13ec3abf8ee0ce0c906690a918
- MD5 468625bfbc5b9c6f04d805bfa3e1546a
- SHA1 c39e0852f79372afd720d45fada6fb3906d8fc35
- SHA512 24a8e52c281133cdc127f7e8e1ea23e0ecf57ae38247e6b63115159e11b746050b405d7d7626b2fd79283bff59ebdf3c390c2df40ca5965e0c7d0344ef98250f
- SSDEEP 24576:Iydo+8kfdQKKtL/CJNyci1baTTnXT11Lp1ftA:PdB8kiKCL/CJAP1bafnXDpJt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline taiga infostealer persistence
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral7
- Target
  48cb6f7d0b36f2bddf99dded0256c01e0ed197a5ea74b14bf98bf561c0cf49c9
- Size 2.4MB
- SHA256 48cb6f7d0b36f2bddf99dded0256c01e0ed197a5ea74b14bf98bf561c0cf49c9
- MD5 8c2e55dd1044f4892380ce8657f5a600
- SHA1 75a534869704df93d70fe71086b3777fb9a39a5d
- SHA512 37b4266fe184fae9a7898b37286f5d9871067bbf80a771b2576c3a44a0a202278ed260ba9468f368e8a2d41cdfed51c567304e261c2c9de40b3fc0c07cbe31f3
- SSDEEP 49152:6snSWMa6fYkSgV2kfXah4MMd1n/4UDtNnKe3t6JkO8o1P3f2p:1l6fYfg4EayBFDznKa6/8kP+
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral8
- Target
  542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a
- Size 430KB
- SHA256 542eb4afaab2b90e95d070cb150ef76e8faa23f3afdd12ab49978cbb72dd389a
- MD5 73f7d4e8343709104d395f26489cc42b
- SHA1 3647210a37ca4eb97210721a09470ae5c2023985
- SHA512 38c32d8eec98525618c1fa38f65e080f065b9dcf64093b88f88d9bc9ddc821c4e3b25a60b7fc8612cffca4446c7c79433be9f17b596de7e9610db8c0ce867cb3
- SSDEEP 12288:aMrHy90uY55c5go2JKza1OfB3JlEy3+mzS:tyzAigJqaofnqyul
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline taiga infostealer persistence
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral9
- Target
  6f328c3e1d2f3ad40a09cd133e1964bbc4fc21dcbb7af8520e97006992426b2a
- Size 936KB
- SHA256 6f328c3e1d2f3ad40a09cd133e1964bbc4fc21dcbb7af8520e97006992426b2a
- MD5 384142bba3fe5feebabb59a1013abf4e
- SHA1 63005b7752afd90117e435958a088af26189f279
- SHA512 ef57a899e63b4311e98810cc9e998d8c3571699a959bb0b381905dc8313364c93ed7c051511078d4aa65d800ae5fc5ef0f81861adc423ecf889521979d097f4d
- SSDEEP 24576:ky/TRNN+q1jO/oCxkTtJepAZU/4eWGgkQAdT0:z/F6ql/6kT7epAZUQwQ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral10
- Target
  74692ca9aa25e702576e835faf8a87d99d208bf02a87a5cd0cca52088e2e27ea
- Size 1.8MB
- SHA256 74692ca9aa25e702576e835faf8a87d99d208bf02a87a5cd0cca52088e2e27ea
- MD5 3c48d87b5cd6967b58c746fc78e70624
- SHA1 544da193b8ac757c57059cc657e3f128869c96d0
- SHA512 3606e207e8895ed36a387083256d485e997cbf4f4691ae91ae16c1c80cabab505af6b46c521647a69dccec8a0db6fbc62c48ab72f543eb89fb43953ac55cc225
- SSDEEP 49152:sB90j4GlIcJysiUv3lWsK8EeCqdTGl8tF:k0EWl91Wsdj4l4F
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

amadey mystic redline smokeloader 04d170 plost backdoor evasion infostealer persistence stealer trojan
- Amadey
  Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
  trojan amadey
- Detect Mystic stealer payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral11
- Target
  759eb38c21f37bb8710a051f23e7ca3b1fca3fafe197b70c2714bc36c21e87de
- Size 2.6MB
- SHA256 759eb38c21f37bb8710a051f23e7ca3b1fca3fafe197b70c2714bc36c21e87de
- MD5 2f237df56b0d9a34018f8194c7930bb2
- SHA1 0a910da14ff438217323d219e65ac7f5ccc162e2
- SHA512 b92fdbd542ef639bba2707ecf8e82182bc5f0394c4f0107ba6dbbc89225fce401d9665a18bd3bf48b4666d5ddacb2dd2cccb768da50e93e222ec13514d927d3b
- SSDEEP 49152:v+Coe9XEDMEUkQSmGzVDprZBO7Eze6y4YCaT1+ousBNLiZ6+eC:WCo6rN70QcyrfR/+0+
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral12
- Target
  858cb57de5b9461a30d4dfd6c797315d00f9582d8210518ba989d761e6fb490c
- Size 2.1MB
- SHA256 858cb57de5b9461a30d4dfd6c797315d00f9582d8210518ba989d761e6fb490c
- MD5 640cf51ca743fca3bace6bee7259a7b6
- SHA1 98cd5880e72e0468dce7132d38d104a974d63466
- SHA512 f42d2ab641a0da50f8dc61d7da4c500b222f0361b310b55d5dda037be1dc331d7c009da99a02e6b0ec3a67c6fdcebe73b1a8ec911673fd7ae603a6ad41dd2e6e
- SSDEEP 49152:FkyMH+ZmK931igX4Yqua48YEo6aT3wmzMSZyd4LlSLwrfuasumyGfnZn0Ee2:OyMelZZs1o6bmISZyKLl642a2yGfnO7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader risepro loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral13
- Target
  9bd29cf05e48e1f9b5f02750f58864848d24e66aab5b629f9133b674bc59b527
- Size 2.2MB
- SHA256 9bd29cf05e48e1f9b5f02750f58864848d24e66aab5b629f9133b674bc59b527
- MD5 41a5588669b0b38da40a5930eb6425bc
- SHA1 d3f879a49d16a82b0deba11f61f651776e926a9c
- SHA512 d3c8004487b9b7d752e1128f6d0f7e01bd893f21fda77e1c46fa4799a70bafa5457d5e8c91d802c05022968f2dc8d25ac21d4045853a0b7558e1cd2d04234828
- SSDEEP 49152:xlyS7Fm/SvrozpOg0vs71TFrRAPmtftq+1PY8Ou:fySFXo1Lx7T1APUk+1ww
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral14
- Target
  b0555f3c536302c5af72051c3c2bc10649a88011e7aa16d3c661971df2866f33
- Size 2.2MB
- SHA256 b0555f3c536302c5af72051c3c2bc10649a88011e7aa16d3c661971df2866f33
- MD5 d8f85c5678c771d84881968f99f3c04c
- SHA1 fe95664a320a6abb2949428bdc77d19a8c0928de
- SHA512 6cc5e3d3d6e5abaa725f3001ac75042ca9e93b03195d941cfc656686ec66e0ceb187187f90eda35d22d74ee7776338ed586aee9969ef25dd9eeb910b357e59cd
- SSDEEP 49152:CeDgvI3FXI9haKZZ+sFYQ+tukBn9oJbsXyWgx1MboUQXE+/UEe+f:EQ3tI3aKZZEtuk59ubsXyFjUQX1Us
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline smokeloader horda backdoor paypal infostealer persistence phishing trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Executes dropped EXE
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Suspicious use of SetThreadContext
behavioral15
- Target
  bde148bc512eb25836030bebc3cbfd472cef53289015dbf4126dd1366b1c6421
- Size 1.7MB
- SHA256 bde148bc512eb25836030bebc3cbfd472cef53289015dbf4126dd1366b1c6421
- MD5 0dff0349176285873256809ebac6eca1
- SHA1 0e1209726d6f571e4a706bd43ee345bdd15bb6d5
- SHA512 b292b3dd5cc13a3fdbff8bbb76392a1d66598a597bb4a7896f7d8d3341d5c3f03a2d5fdfb9499702a2b2ed49e4d6e347ac8d2fd09010125374adffe16b6fa37b
- SSDEEP 49152:GACYh7JW4zNxiDnbrM9wgZhh10mT7sPf4Z:JW2R1aPfs
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader risepro smokeloader backdoor paypal loader persistence phishing stealer trojan
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Detected potential entity reuse from brand paypal.
  phishing paypal
- Drops file in System32 directory
behavioral16
- Target
  c7e81c037737d5a821cf236c8453b7b00607cd99d42863e39e0d703c731be6b0
- Size 1.3MB
- SHA256 c7e81c037737d5a821cf236c8453b7b00607cd99d42863e39e0d703c731be6b0
- MD5 4238760d892c63a0ef06aa4561983522
- SHA1 502cdab869323baf4da5309cb3274c8e2e6a4f4f
- SHA512 6d930eb6e09119383c762e70d3f5f1b86a9e2c821b771a5cea76df11b181102700abce9fc4b8c293ecce6567b0c785350e98231319fd5842e981e09afb6c3170
- SSDEEP 24576:/xRwZZKMoGR1usORnA64Qa7C10zLwJOYfmSYb:/cKMoGR1usa3aW10fwJON
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Suspicious use of SetThreadContext
behavioral17 behavioral18
- Target
  d0c5f5c327d3c5cad19261fe1e5c8af4374da45c48236a7064c548a425e23a0e
- Size 2.7MB
- SHA256 d0c5f5c327d3c5cad19261fe1e5c8af4374da45c48236a7064c548a425e23a0e
- MD5 f67f35ac7610cbe97a565edb1bb21888
- SHA1 b1e29296bf2ce79986ce6a6e838cec54674b41a6
- SHA512 51cbe2476a144e6627ba4b255e34356474a5b8767bf3771a452bb2842149d04fa77332165e42bbce8868d70d7e9336332456efbcb21c725c10c8d9d728a8513a
- SSDEEP 49152:XDCyB8KcRG7A2LrmPovoLFXU44EMT7OGxV8vFamCkRyNo+n8a:ZO1G7A2LcowLqPEC7Oe8vAmCkwn9
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

privateloader redline risepro horda infostealer loader persistence stealer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral19
- Target
  d165dd77039589d5d25d898e400cb1806ef4225f7b6af17c51cc83c2ec12d070
- Size 1.1MB
- SHA256 d165dd77039589d5d25d898e400cb1806ef4225f7b6af17c51cc83c2ec12d070
- MD5 21a0e0b082b60ee185eb74abf010f342
- SHA1 b0ec7b5c9f40dddca80cec545081cdc3c5cc8c18
- SHA512 8a24cb408b62274ec3dcc0720694fb4a0bd565563d40e436bc78419d737cbfd2679fdd2077959b80a9ca79bc36e79cb08f419221b42a624eb2c1102a024b2807
- SSDEEP 12288:XQCUd1yjt0OFYsMeTVRq6zlXO4iIEbJGHaKwCugkgqawdpPlZ09TOoWtY4ogvZGn:Cdgx0OFYsMeTVRfBxIJGwceje
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

redline horda infostealer
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Suspicious use of SetThreadContext
behavioral20 behavioral21
- Target
  d9645ca9ce715a28ec2e2bfb66f661e256335f09bba61c0b86d73a530dacb15b
- Size 1.1MB
- SHA256 d9645ca9ce715a28ec2e2bfb66f661e256335f09bba61c0b86d73a530dacb15b
- MD5 d92888066793d326a49b21e7a091d25a
- SHA1 e08eeaf2c76508e1fbced904177ad68f055d1344
- SHA512 3595c349657597fcc1e692226c9e5675486de21075b94d452e8729754aa1687489b5cf65f74d17f53b07f988072de09fe81a9db2c844e1f52342e988f6a9bce4
- SSDEEP 24576:1yzt5x6zpWENBhJ60yaE8zyJq1h/yLj1IhU1fS8DhnGR04l2IjdeSiRA5:Qzt5xEWIbyGN1sNLhl4lDJ8R
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

mystic redline kukish infostealer persistence stealer
- Detect Mystic stealer payload
- Mystic
  Mystic is an infostealer written in C++.
  stealer mystic
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral22

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

PrivateLoader

RedLine

RedLine payload

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

PrivateLoader

RedLine

RedLine payload

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Detect Mystic stealer payload

Mystic

RedLine

RedLine payload

Executes dropped EXE

Adds Run key to start application

Detect Mystic stealer payload

Mystic

RedLine

RedLine payload

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

RedLine

RedLine payload

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

PrivateLoader

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

RedLine

RedLine payload

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

PrivateLoader

RedLine

RedLine payload

RisePro

Drops startup file

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Detect Mystic stealer payload

Modifies Windows Defender Real-time Protection settings