Extracted

• • Target
    01ff144b49f948b06c93a24f6924afd9.exe
  • Size 429KB
  • SHA256 106f44512e66537d4e5f1b0b08c561951882eb3bdf5e648cebb4c5a9a2ba3c8a
  • MD5 01ff144b49f948b06c93a24f6924afd9
  • SHA1 bb44f0dd41b0a971d0cc1c1b4069ce802f79e73d
  • SHA512 3a37b3b38d56c1eedb25f510fff5192aacb3be5a99b439d254a3b6f15e6d016c2686c8c72d82aa383147f4d0dbbdb1bbf9f4464c2013f5ca47a67327e12c4286
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2