Extracted

• • Target
    22969623be1f678d39ab1df708469407.exe
  • Size 429KB
  • SHA256 67c798fa66f431640bbe46c525ac2de543a2c2e7b6cc59e5967d8bc5d37b01cb
  • MD5 22969623be1f678d39ab1df708469407
  • SHA1 fe7aaf6f961e693880721dd05dfdff8fb2e0fa59
  • SHA512 da6f172acd72f6f858d457c00e4003ecb0bd155a54fc67acb8e419d30107b863733364d9c191228b8c202158d3c3ea087e89aee991477c0a864d6e2a9d1e0b0d
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2