Extracted

• • Target
    229bc019bf32a2f8e5451f11fa9eedff.exe
  • Size 842KB
  • SHA256 4a4ba0934936df0b796b0c03690609b6596ccda0f434b59d5faea600157bc85f
  • MD5 229bc019bf32a2f8e5451f11fa9eedff
  • SHA1 56d69a0f7c52f5f000a581180d23f6eb799915fc
  • SHA512 9326e11f47c2af8c34cd0688e020c233a408705cc207cd6f7f3d1896885b2dcb7fccb8d4970f33f8ca0831017e2d4d24e48d3372789a7dd998f2a66cc0ea1f78
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon1d76a465540f6a904ac9f1310fe3a3824b5b4549discoveryevasionpersistencespywarestealer

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    evasion

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2