Extracted

• • Target
    5c8050e907434066c6857344215641a4.exe
  • Size 423KB
  • SHA256 2b18d06c8dcd5526c85b3adec55515b410b2c80ea586d26e02f3c238b93579b8
  • MD5 5c8050e907434066c6857344215641a4
  • SHA1 ef7baba758b95b0981acfdac7eb5277df0b8164a
  • SHA512 13b8da7d3bec8c282116af1338ff306eed00dcc6fafc21cab985814f64848508622e6abcebbb74f676060f498f1f73098cc9489549b626dd540f3ab573ae6242
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2