Extracted

Extracted

• • Target

    944e549ba4db11ea3f94a2873ffbe693.exe

  • Size

    836KB

  • MD5

    944e549ba4db11ea3f94a2873ffbe693

  • SHA1

    c72eed628c38740d753e823f96873b0eedcbbd50

  • SHA256

    a486d1f0ad1fb2729dbbcd5d3606f30566f86abd3f2d5218c11077dfeac95f0e

  • SHA512

    1aa1492996f6546c693e66857adfe3d4b771aeb8b6923881f799c17aa86bcd9dac16bf55234335800b04a9a7df7ba6f578d00eeee52dcfe263c83ceee4e9d14d

  Score

  10^/10

  ransomwarespywareevasiontrojanstealerraccoondiscovery

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Raccoon log file

    Detects a log file produced by the Raccoon Stealer.

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Windows security modification

    evasiontrojan

  • Checks for installed software on the system

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

  • Legitimate hosting services abused for malware hosting/C2

  • Modifies system certificate store

    evasionspywaretrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2