Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600

  • Size

    315KB

  • MD5

    b52c132e6000c854d16a83c40409977f

  • SHA1

    c1d708eb3a35a3e0665d92c0a98ced9db2419923

  • SHA256

    dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600

  • SHA512

    c25f18574864afe84468a64a932df0aacdd3efe788f0ebda545153017c2af50ec75dfa64dbe683943e90ae48261c865cd35c24e16af37c0b2639798762ae2f48

  Score

  10^/10

  raccoonredlinesmokeloadervkeylogger675718a5f2ce6d3cacf6cb04a512f5637eae995fddf183af4241e3172885cf1b2c4c1fb4ee03d05aimbeststay clean superstarbackdoorcollectiondiscoveryinfostealerkeyloggerpersistencespywarestealersuricatatrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • VKeylogger

    A keylogger first seen in Nov 2020.

    stealerkeyloggervkeylogger

  • VKeylogger Payload

  • suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

    suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1