Extracted

• • Target
    4dd2bad66af68ade063471ec97a9e549.exe
  • Size 603KB
  • SHA256 d5ceb138f6efdbb08fb975cb10b91ea50fdd0aa87066ba5db0bdf9c0aef93cbb
  • MD5 4dd2bad66af68ade063471ec97a9e549
  • SHA1 96fba0ac17703d12b05f6cce8105c85e386b2ceb
  • SHA512 06e02c778e5b7833db9134e57824a03031a3d09571cd41cf55e49db81bf38d6d4b4f4fb133ef06405da8b970a9c4be7a2dbcdea95eb617ce6eca5df364603cf9
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonb8fb1ad683e5c551224b98d36f4ead260255476bdiscoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2