Extracted

Extracted

• • Target

    cc5c3d6512bbc0e90d670e8a61481ca1.exe

  • Size

    580KB

  • MD5

    cc5c3d6512bbc0e90d670e8a61481ca1

  • SHA1

    cd7a8e51b413de2343aac98971d37e6363863de4

  • SHA256

    bf97fab7ccc6d55f68b6563e8c68541f4b8db1cbcb841dce67663d9e4d7938b1

  • SHA512

    bdc5719449433ea8a9d0066d900f843b66e4817bbe893a99a798cc57d11ad0ef23f34c6b6382c4d9fc76d140a51e5da3d1167ba60940234b927fdd2eb3270662

  Score

  10^/10

  ransomwarestealerraccooninfostealerredlinespywarediscoveryevasiontrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Raccoon log file

    Detects a log file produced by the Raccoon Stealer.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Checks for installed software on the system

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies system certificate store

    evasionspywaretrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2