Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    b503e95080871d70f3a758124d473ed31a4ede3d2e87d252d3bc878868274023

  • Size

    929KB

  • MD5

    a737b257ab801b1aaf46b684cfd5e42b

  • SHA1

    d66bae3ce29fce2828a41f85b2040df0187fb10b

  • SHA256

    b503e95080871d70f3a758124d473ed31a4ede3d2e87d252d3bc878868274023

  • SHA512

    d02d8a316f5cb61f5bae7174c48ce8c17e2a8e731e23252c7a05653a795c81a6e62eab4a5c71a756b5aadca1f84cfaaeebcaa898bab101987cc4d7f22ba08742

  • SSDEEP

    24576:pAT8QE+kVVNpJc7Y/sDZ0239GhjS9knREHXsW02EBKac:pAI+eNpJc7Y60EGhjSmE3sW02EBS

  Score

  10^/10

  raccoonredlinevidar4507635788776426c3f362f5a47a469f0e9d8bc3eef@tag12312341afb5c633c4650f69312baef49db9dfa4nam3ruxarr_ggdiscoveryinfostealerstealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon family

    raccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2