Extracted

• • Target
    93532ec910e766b6cca04ab05eb4efab.exe
  • Size 456KB
  • SHA256 21f678e40a509402875f2fc2d8701fab4d45580cf698f0848bddaa81cbcf47d8
  • MD5 93532ec910e766b6cca04ab05eb4efab
  • SHA1 d9044c7053df4533d59ba44ebb02507ed42baa31
  • SHA512 54ad24562b4a3859ecfeb05b3c9d12efb7f39c984787c019ff59ec4650db8cb0815de323b789488b7b33d0b3de1c91302601fdda623c7622f52b20cf50bb44d0
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon38e2f62d887d39c6db08d68fd47bd92cdb6c89d2discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2