Extracted

• • Target
    7d17a86a5bf1513e56e01d7468be87db
  • Size 497KB
  • SHA256 5b46df5a271c4e35adf1027792e4035301ae87fe4a112f89f507b37522b541be
  • MD5 7d17a86a5bf1513e56e01d7468be87db
  • SHA1 5a6d18b801c333a2c93c99aab7e2048f12bb433a
  • SHA512 51c7896c8595b07688eec3a971f4fb952185eaac7c4c5474b61dc62e6ebfd14abbc89ec7ea1f89ccb334dd8a26cf670c29e143808f2f2767a4a05f48e489c6b0
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon2ca2376c561d1af7f8b9e6f3256b06220a3db187discoveryspywarestealerpersistence

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Raccoon Stealer Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2