Extracted

• • Target

    apphost1.exe

  • Size

    2.8MB

  • MD5

    19dbfa49c5ecc6054420a62f7fd890d6

  • SHA1

    8a1aeb1445917ae186ff09932085b18564d08187

  • SHA256

    608097b33943a9a4b14bee255680724f2fe830474766fe6462ccfffaefd517cf

  • SHA512

    5bd992dbfdbe4faf922cef59aed28a37cfa111ac6cc568ac881a6288520e34353ba30a399096f10b1c93d80ec51de382976103b676a4f32a86343c101cdb7b21

  Score

  10^/10

  ransomwarespywarediscoverystealerraccoonevasiontrojanvmprotect

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Raccoon log file

    Detects a log file produced by the Raccoon Stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Checks for installed software on the system

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2