Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    0b4df70b068c231a06bb8fcc5a256e34
  • Size 929KB
  • SHA256 3ddb787dc820ae5ac61121bc0ff42e0cc86164f00bbe694d524497bd03123e93
  • MD5 0b4df70b068c231a06bb8fcc5a256e34
  • SHA1 29ecfc8234162b43674d90e137546a4ecd4f65d7
  • SHA512 603a19c3c084bd71dbeda26d34d3d179d1c7f1eb23f4f411a83cbb4d365482885794763fa0d9711dbb6a383a32e60e8ec50aeacce7b87c859b70bf8998ff958b
  • SSDEEP 24576:pAT8QE+krVNpJc7Y/sDZ0239GhjS9knREHXsW02EhY:pAI+wNpJc7Y60EGhjSmE3sW02EhY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  raccoonredlinevidar4507635788776426c3f362f5a47a469f0e9d8bc3eef@tag12312341afb5c633c4650f69312baef49db9dfa4nam3ruxarr_ggdiscoveryinfostealerstealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon family

    raccoon

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2