Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    54BCD3308C140C8EC030F98697CC7F0E9D4585D54334A.exe
  • Size 3.8MB
  • SHA256 54bcd3308c140c8ec030f98697cc7f0e9d4585d54334a2eb77c58879510d5c8c
  • MD5 325c6021ce7b691f124ec4ee2024ce28
  • SHA1 673eabe039a32982a47d088342844775822996c8
  • SHA512 93f9c2eb518e2dd941c2e23133ecdc9637f3f365fd2c64ca5eb33d7162ab0e5c19da7ecd9718266c51b0882c7ebf969c9388a7fa70d67be97895e8afb7c54e4a
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonredlinevidar11281bc6116182dfd33bce1052fe9bb04159681610304c585dd595f87d872b81110ef04a868eee9e5c6baspackv2infostealerspywarestealersuricata111426ba8731a23ebe331ca665e334da5a21506c1e2dfie

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2