Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600
  • Size 315KB
  • SHA256 dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600
  • MD5 b52c132e6000c854d16a83c40409977f
  • SHA1 c1d708eb3a35a3e0665d92c0a98ced9db2419923
  • SHA512 c25f18574864afe84468a64a932df0aacdd3efe788f0ebda545153017c2af50ec75dfa64dbe683943e90ae48261c865cd35c24e16af37c0b2639798762ae2f48
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonredlinesmokeloadervkeylogger675718a5f2ce6d3cacf6cb04a512f5637eae995fddf183af4241e3172885cf1b2c4c1fb4ee03d05aimbeststay clean superstarbackdoorcollectiondiscoveryinfostealerkeyloggerpersistencespywarestealersuricatatrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • VKeylogger

    A keylogger first seen in Nov 2020.

    stealerkeyloggervkeylogger

  • VKeylogger Payload

  • suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

    suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

    suricata

  • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1