Extracted

Extracted

Extracted

• • Target
    7dfb2f23de7ab9bb70929798cc42cbfb
  • Size 504KB
  • SHA256 fe3d7939166e8e6ae965d66d98f6ee5583e535b575ba194aef038c6c1ea15ae4
  • MD5 7dfb2f23de7ab9bb70929798cc42cbfb
  • SHA1 5ead65f966333aa571a4679999374113c4fe66c5
  • SHA512 d9d6628d5d9db870cde1724ac513fe019ae6c28f9ba38fb4441c36bc6fec28ef3e59b005d8f991ca1e19482f166f04a18d6c8d81cc6d830ad68b316e5da3b97e
  • MD5 SHA1 SHA512

  Score

  10^/10

  redlinediscoveryinfostealerspywarestealerraccoon34b5c357572382155552cb40207e952f9f95264bxxluchxx1

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2