Extracted

Extracted

Extracted

• • Target

    0338583080f32e338bb25504417cfaa15c8527cd848091c953424e32f72c49f4

  • Size

    335KB

  • MD5

    1c2d9cf0208c5c8c374ccf93236dc800

  • SHA1

    5cb496c2522c3d139b77b0225eff2b79d2d1b761

  • SHA256

    0338583080f32e338bb25504417cfaa15c8527cd848091c953424e32f72c49f4

  • SHA512

    34b800572fb16034a19febe7e870a04b349d10358e2f60d31a9956b591df351b08a12123d7fd28ec70b6a96a712ed44a74e613278c793408d4c2fcc2beaf0787

  Score

  10^/10

  raccoonredlinesmokeloader7ebf9b416b72a203df65383eec899dc689d2c3d7a4b1cb9c5c4d693cc9860fbe648999419f9d3d4fbackdoordiscoveryinfostealerspywarestealertrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1