Extracted

Extracted

Extracted

Extracted

• • Target
    d67557b9c2e2eedfe6ac9531444ffdbd.exe
  • Size 220KB
  • SHA256 e5ad94ed3a665a25dc7a9aeba84af60f52d134878bdfda700f48d915c819d626
  • MD5 d67557b9c2e2eedfe6ac9531444ffdbd
  • SHA1 002bf98103b6ce27a3ed1a4eb63d1f940c7cdf10
  • SHA512 b18a2a354db1067131d1d7c7bbf4515ecfa7c5488f79f014771289e44be624554d48d2a64c02af23ffa7b9e91efbd2fea25662875ebd4793a07880e60e958496
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonredlinesmokeloaderddf183af4241e3172885cf1b2c4c1fb4ee03d05asuperstarbackdoordiscoveryinfostealerspywarestealertrojansuricata

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2