Extracted

Extracted

• • Target
    A9F400B739DB381FA4D0EE9DBDA0829407400033B2D5A.exe
  • Size 292KB
  • SHA256 a9f400b739db381fa4d0ee9dbda0829407400033b2d5a541b528a6577492f07b
  • MD5 8fdbb565db60af13fc39730c9993ff91
  • SHA1 c318c02da8a4abeb5f2b8c40169e91a3f28395f9
  • SHA512 a04dd40ae94492ce691101011e0eb56945c78d5fc5c6bd1b3c98dc3f1cb74db29d501c91f1938166540d3e28cd51a4165dc60e51ab54b90a58842d5aabe4f4a8
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonsocelarsafb5c633c4650f69312baef49db9dfa4spywarestealervmprotect

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer payload

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2