Extracted

Extracted

Extracted

• • Target
    171537f40a9f7744a0e510c24febf2d1.exe
  • Size 323KB
  • SHA256 19e12e0f5eb46b293c8fa069a6f82e112bb9807046856e2be6cc6ea74278b673
  • MD5 171537f40a9f7744a0e510c24febf2d1
  • SHA1 c2d53406e5973fe77ca342df0aa4667e142dd4f2
  • SHA512 d652b641361f7c798b6b1c346ec295cb398485b499062e834420b5d448d590830780d26e73170f8c6f648f90a369dbf89acf47cef9daf38b64b266e5f8bd2556
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderbackdoortrojanraccoon50f8ded12c46443e43915127b1219ac2fc439bb65339a5db91bba8fa758672b05e7eb691a224bf94discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2