Extracted

Extracted

Extracted

• • Target
    33a3cc86c130bc762dd77ec72d829dd8.exe
  • Size 326KB
  • SHA256 e58ea2af775f4ae34d100e668d39e11e439579bfe1cd5e0031ebaf65d59c1aa1
  • MD5 33a3cc86c130bc762dd77ec72d829dd8
  • SHA1 482162937c4dd4a83a0ca992e5f24f27ff35d007
  • SHA512 eaac77f87be8bd83822756e88ef45c8c5166a929eec96f7e92340a1cf9c88b96a95b8567c906867bf6c94f2cd86024846033c980680f3dbf993aa031b9a5bb2f
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonredlinesmokeloaderddf183af4241e3172885cf1b2c4c1fb4ee03d05abackdoordiscoveryinfostealerspywarestealertrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2