Extracted

• • Target
    adedaf5e119be48cc90bf8b7851f9e5d.exe
  • Size 456KB
  • SHA256 8c6bfcef8131e02e228eb4e94537deb8c15f897eeaee0086f67e0bb6c45066f7
  • MD5 adedaf5e119be48cc90bf8b7851f9e5d
  • SHA1 08b30e6c30e66bfce82bd7e573f02b939a41bda0
  • SHA512 82e2c5b23e5c857673bfbc0beb3afceb2ad11c5624f6daf2a256c98eebd3c4d288129f0f550b6b374908e955d9feee3edb0893307d7cdbfce8c378ebffce0d89
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon38e2f62d887d39c6db08d68fd47bd92cdb6c89d2discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2