Extracted

• • Target
    af175128a823db1274fc244d8f5a46bd
  • Size 16.6MB
  • SHA256 fc10619c7cb6b5de6ba8f58fd3ff889045ef77ea4cde4de7c5f313dbef1a7bc3
  • MD5 af175128a823db1274fc244d8f5a46bd
  • SHA1 9d67400fb5818a6c573c36eac8650458d7f1d07e
  • SHA512 2fbd782242a4e57c2563cf4eb46d0bfca337839f126b93eca96a8c9a06377034336770c368da0c703ed2d7907f49d75b722dc688c461de1000e46c32368fe19f
  • SSDEEP 393216:7Q4l1FoGr1o4X3LKq/LnF+aOeuKAxt9zpaz3y6Jqx5mDsLOVEi:7Q4l1Fo455LnVupJpa2ADsKVT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  blisterraccoon6f477b98912ea3958a37585999397f4fbda5dc46loaderstealervmprotect

  • BLISTER

    BLISTER is a downloader used to deliver other malware families.

    loaderblister

  • Detect Blister loader x32

    loader

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • Loads dropped DLL

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $TEMP/lib_npp/libcef.dll
  • Size 29.8MB
  • SHA256 c1e6d8d159d05d34b6d97ff8629c0a266dd7b7c0665f19a5defc33aaa307f5e2
  • MD5 0e8f94415c1e7694cb6b88bbf17f9339
  • SHA1 df8be7a1694144e1613300c9e60da321b49fdd79
  • SHA512 9f09399507b41c50a9838c1a26debcc3a405cc8c2191bbb7ef6d8b52ce443e532ae90ddd03a1f6a0eb50b2e8cd6b42a542872e8d717353692f0ecd82fef1b7ff
  • SSDEEP 786432:u7GbWhs7Bcgr7wOw/2jt+KOY5rr4/ITehQ57c/RO2Tp7XvQT5:NbWhs7Bcgr7wtKt+KOY5rr4/ITeyc/RK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  blisterloadervmprotect

  • BLISTER

    BLISTER is a downloader used to deliver other malware families.

    loaderblister

  • Detect Blister loader x32

    loader

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4