Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    C7304FF0966068D305DA031F9DA60C5B0EBE32AC43533.exe

  • Size

    4.4MB

  • MD5

    d13d7a330bd2b99acb5c445bb14ab499

  • SHA1

    0a598d94482ab95fe1ecd2a0741eb39b7d7defb2

  • SHA256

    c7304ff0966068d305da031f9da60c5b0ebe32ac43533d27f50190f1ba549347

  • SHA512

    9c754fb692a95daeb895cfd4acbb09b84c80b217b5b7dfb27ae75bc9ae9560e8a8e09e49424fcffaba0e2f365b79fb51fc4a69f5b580f0ddb1308c896d33d82c

  Score

  10^/10

  raccoonredlinesmokeloadersocelars2f2ad1a1aa093c5a9d17040c8efd5650a99640b5chrisaspackv2backdoorinfostealerstealersuricatatrojanfucker2media18

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars Payload

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata

  • suricata: ET MALWARE Suspicious Download Setup_ exe

    suricata: ET MALWARE Suspicious Download Setup_ exe

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2