Extracted

Extracted

• • Target
    7b43102eac227f292e0534dbcd99e797
  • Size 2.2MB
  • SHA256 72464c7a10469277dad3ff7f30c51f1d3db03076b2feb2e2ac33a9749d44e64d
  • MD5 7b43102eac227f292e0534dbcd99e797
  • SHA1 8fb98d4607708861a4f8a71f423ee3727ae7793d
  • SHA512 80bc25a026eac0a34c5a3569f298b46e98d64beb3581fb1a0ca10999f64015b6fc00107e91f4126c7d099663068649781f323689edf910b8363980b1bfcd0c86
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonredlineb1a595eac9265caef93f4d54354e4e71594872f2qqdiscoveryinfostealerspywarestealersuricata

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2