Extracted

Extracted

• • Target

    78a9e83c3ee9695abe5b1698d4f594af.exe

  • Size

    573KB

  • MD5

    78a9e83c3ee9695abe5b1698d4f594af

  • SHA1

    0903a4861c23d3606048dedf0e11d0f95bd18f02

  • SHA256

    5c014fbda22ed7eb3e16d6e7cefc5a2763dc3a7a419e428022dc58334e9770b5

  • SHA512

    330a51e94e6893eb23733deaf02785314902a4c7572534bbb010210edd5a2575a658323c6953c0ce6eee4bc5b3596837b30d06c17daea1526d883f0973192cf8

  Score

  10^/10

  ransomwarestealerraccooninfostealerredlinediscoveryspywareevasiontrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Raccoon log file

    Detects a log file produced by the Raccoon Stealer.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Checks for installed software on the system

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies system certificate store

    evasionspywaretrojan

  • Program crash

  • Suspicious use of SetThreadContext

  behavioral1behavioral2