Extracted

• • Target
    Invoice 0045 & TT usd27,004.exe
  • Size 1.2MB
  • SHA256 445bd1c221cff019e52db89d03e05a8c22509cea0ede28da6d55bff7fd840bae
  • MD5 4205ea3c1211991e6d906b243cca7589
  • SHA1 fce2c4a2c95f1e632f774948b6d66cc5c34d2434
  • SHA512 7ef1f0f4de6ee1eb452219924bba083bda064b683e674a4f8da2361be4c024a786568a02c1b613c3914d501a573f3c2c59a5392a161bd43107124d07b3ac5964
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon829b8253290a33cf285fa6fea2c8437d0e687ddediscoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2