Extracted

• • Target

    e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468

  • Size

    5.4MB

  • MD5

    583887cee4177d59e84674f832cd504f

  • SHA1

    15706ad30a48d0bc66a2b91367c0d4eeb877c375

  • SHA256

    e52a74fb629774299e5a859574746b2fc1041f1b1282c5fa486a824551098468

  • SHA512

    844cba185a146883c75d14894ec74dd912a38c499df6250d88ce1385f554170a13c0feb1071205a9499777130b440e277663e2e11a0da1fe1cfab90ef86b3175

  Score

  10^/10

  raccoondiscoveryevasionpersistenceransomwarespywarestealertrojan

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Raccoon log file

    Detects a log file produced by the Raccoon Stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • ServiceHost packer

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • JavaScript code in executable

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2