Extracted

Extracted

Extracted

• • Target

    4735a64e5d517a5c55a53557e089a7cf62845ba629d1753f34ec4730b889aded

  • Size

    251KB

  • MD5

    35cc2057342197542eedfe1eec4469bb

  • SHA1

    089a57bd193c0c5076081d86ea979effc8ed2478

  • SHA256

    4735a64e5d517a5c55a53557e089a7cf62845ba629d1753f34ec4730b889aded

  • SHA512

    842333dcf97cc9ea44955917d58c3aec9a142c2dbcbaf070c0e372db329eece2287cf3dc7f0d7ec09e7b81644ccaddbdce9d6886b5d1c4d9ae5d341efe4cea60

  Score

  10^/10

  raccoonredlineremcossmokeloaderb620be4c85b4051a92040003edbc322be4eb082dj3j3-usbackdoordiscoveryinfostealerpersistenceratspywarestealertrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1