Extracted

• • Target
    b79b4e61f5805c0d91d79cf7374ae7c8.exe
  • Size 431KB
  • SHA256 552f188d43cfaa780bd675e6bda5cee09343d7e4f141eaec8d716aa1d62694e2
  • MD5 b79b4e61f5805c0d91d79cf7374ae7c8
  • SHA1 2d1f92d7b7dd5eaebadded62b2618584b1e6538e
  • SHA512 52c82d5d42338708be51df5c5cf1ef4d2f0c9d50f2d77129d8ef572ae55563f151bd52411dfbb9c8663debec387208aef38a0ae0885dda77f0eaa93a784d2b46
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2