Extracted

• • Target

    CraxsRat V4.zip

  • Size

    145.2MB

  • MD5

    b9f85a70824ca397dbfb2e954b1ddbe4

  • SHA1

    da21276ef4b8f6e7e41edd786189dcc2b5299210

  • SHA256

    f5526509fddb95bde20e9127e2319112966833a530bd3bb71bcb0298779609cf

  • SHA512

    fb89f08923fc7a7b303c9d92403d0e22fbc92b5a87ac363628c7ea6574b8b7161aed62d04e2a0418cf4bc535602604d72e9f360c550ee273b8efeceed0327987

  • SSDEEP

    3145728:XsrCnvC4sBcEdm7rYPJFPihoQPZbSVmtNyhj6NmiXQKAp91Wg5u35kH:Xf2CEdmviPiyQxbhchjmmiXoN5uJK

  Score

  10^/10

  hawkeyeredlinecollectiondiscoveryinfostealerkeyloggerpersistencespywarestealertrojan

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Hawkeye family

    hawkeye

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook accounts

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1