Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    7ad2ecc56160b66356e7b1c0a237bbea3a687e100b3bd9a14c4b4a23bb095d05

  • Size

    904KB

  • MD5

    370447cce517cf145a08d03bd3a7f98d

  • SHA1

    13a9323ed2f5594f37d00c0ad43d0ce41fc99a1b

  • SHA256

    7ad2ecc56160b66356e7b1c0a237bbea3a687e100b3bd9a14c4b4a23bb095d05

  • SHA512

    4bb7897f82c5d84ffad17ea22f0bda7533385d1576b8d5dd04b6f2828cb956918c1b727458f4b72e3ae654493aa146fdf5e591d271193ddf98ae8ffdfe9e361e

  • SSDEEP

    24576:pAT8QE+kFVNpJc7Y/sDZ0239GhjS9knREHXsW02Eljns:pAI+oNpJc7Y60EGhjSmE3sW02Etns

  Score

  10^/10

  raccoonredlinevidar4507635788776426c3f362f5a47a469f0e9d8bc3eef@tag12312341afb5c633c4650f69312baef49db9dfa4nam3ruxarr_ggdiscoveryinfostealerstealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon family

    raccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2