Extracted

• • Target

    ad52fe47e410dd4a3af58e2ba9a12f09.exe

  • Size

    513KB

  • MD5

    ad52fe47e410dd4a3af58e2ba9a12f09

  • SHA1

    d2b0a73a2ee76a4b47308e19fd96860fbf05f050

  • SHA256

    58813f984233cfb9eef1c9abefa7f58e96989dd9d6ebd903d40dc2cf3d56c5e8

  • SHA512

    48a6dcc62152392d82f8a567ed904114e114485419b7325e9a547e0f8a25df0e13cb594acf1ef3a04748bb27d94c436d74ff619942cddce559d00ece212f9a75

  Score

  10^/10

  raccoonredline78411f0665662955fb66b9440064e971183457eediscoveryinfostealerspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2