Extracted

• • Target
    cbbac2273a64f48a8d804df3b591b4bb.exe
  • Size 429KB
  • SHA256 70a7ea01f9b72bce12827971f0208c90d631535ba2d96286a67cacf6e62a13cf
  • MD5 cbbac2273a64f48a8d804df3b591b4bb
  • SHA1 4eb56ea5d2667ca37bb94439d6a9e38c0468b702
  • SHA512 39395ce56bba5483d5295f13963a817d9cdb7e34ef2e73733053ad1ddf281e36ec528902e1c4819eaacbcf3ad50d2b74d5399c246e795043b848aa29a70d3fe8
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2