Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514

  • Size

    916KB

  • MD5

    507d8b23a93c2f5832c2585f1a6b602d

  • SHA1

    657ccb76cf81e45114364e8ee287dce0257bc835

  • SHA256

    29d877367db8db212c287c1d00ae96b837c492a7053d945a16db52ab100eb514

  • SHA512

    f7a3aa549267e6d84d0664ad152bf46ec87c606bc74e29750f2a5725a8fa0aef23f87362eee11cf9c6c7855d30c3592baa77f38975d47ab351d04ff64c6528ac

  • SSDEEP

    24576:pAT8QE+kEVNpJc7Ycw4Th7k16ThM5dJ5Om46EYjdnx+Z3:pAI+bNpJc7Yc7dXUxOm46Fnx+Z3

  Score

  10^/10

  raccoonredlinevidar152115715507635788776426c3f362f5a47a469f0e9d8bc3eefafb5c633c4650f69312baef49db9dfa4nam3discoveryinfostealerstealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2