Extracted

• • Target
    d9849cf49660ccb07d7a2066b9bddbc9.exe
  • Size 455KB
  • SHA256 7e1526e8a418dc74b5d9d2666ba67cb511bead21bb770db5a75dc7e4db77a90a
  • MD5 d9849cf49660ccb07d7a2066b9bddbc9
  • SHA1 69262560cf5216d50e9b289863f1946c6a0fc71e
  • SHA512 7e5493b5caa13b41860a74cc49affc566341d249dd15969eb06482b3b0ccbe48966d3099b88efa620124f5638f7820a2033e8cb699feb5504b724eb3b172e70c
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon6e76410dbdf2085ebcf2777560bd8cb0790329c9discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2