Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    54601d45a229469f2909404bc448ce2fcb6d90319d7b62adcbb36d48560b3500

  • Size

    1.1MB

  • MD5

    db2082d65265145d992f05920fcaf442

  • SHA1

    84edb3496b2bb8db9fab5dbfaa388724aa3b2214

  • SHA256

    54601d45a229469f2909404bc448ce2fcb6d90319d7b62adcbb36d48560b3500

  • SHA512

    55b05af2666a47d7728e90c0bacdeef50d1401ef423d63ecf20c0400a6a82f86004f1af166857684a097e0c960a9ba1d18ef86144ed8d2bdf98b477bfcc08ebf

  • SSDEEP

    24576:pAT8QE+kiVNpJc7YMQGOna45spYKQMtQY/IYHiQqA245zVYjqGSQy:pAI+XNpJc7YMVItmftJ/UQ12qG5SQy

  Score

  10^/10

  raccoonredlinevidar15211571576426c3f362f5a47a469f0e9d8bc3eefafb5c633c4650f69312baef49db9dfa4nam3discoveryinfostealerpersistencestealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2