Extracted

Extracted

Extracted

Extracted

• • Target
    5c833832be02cb12a7d808e81b051f4e.exe
  • Size 219KB
  • SHA256 a5e15b60683685e7a359e8461ac29b991b1ff20903e121df8a7a09d9fdc78b32
  • MD5 5c833832be02cb12a7d808e81b051f4e
  • SHA1 8da3a637abd601d68cf8240ba8e7c2e919d1faf0
  • SHA512 db538420478618e71745d149790cfd39dc8ce9659296e9e6bbb90a91528ead53117c7d413dce35ce81f2428f6ef00d4279df1c237159248ed7d4d99c1ecbbe0d
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonredlinesmokeloaderddf183af4241e3172885cf1b2c4c1fb4ee03d05asuperstarbackdoordiscoveryevasioninfostealerspywarestealerthemidatrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2