Extracted

Extracted

Extracted

• • Target
    15FD29325E11AA1777BDDE1E09829784.exe
  • Size 3.2MB
  • SHA256 2ec6c6341ff83005a6515d942976d2092549312d419a29e59d0efb15d65749bf
  • MD5 15fd29325e11aa1777bdde1e09829784
  • SHA1 276c234a544054072593fb3b87e2a37f81e4f3c5
  • SHA512 53a1d60c2e6b679b89effb81da0cc0bce4d26644d5ce190258ce6d9821802bb8aa1f349a61567d4806f19acbcdb34e6a3cb66d72a4a8169223165c7396eda02d
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonredlinesmokeloadersocelars9fd53b475fc64a3ea667b6e92477d7b54c1560a6мощныйagilenetbackdoordiscoveryevasioninfostealerspywarestealersuricatatrojanvmprotect

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Raccoon Stealer Payload

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine Payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars

  • Socelars Payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata: ET MALWARE Possible Dridex Download URI Struct with no referer

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • autoit_exe

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2