Extracted

• • Target
    94f53cdf8b29381aae1b0ce158bdc8a0.exe
  • Size 456KB
  • SHA256 f310e36adaa404c8ab703c29380547dce7d7c2fd4cf508fb7a18264052d4f545
  • MD5 94f53cdf8b29381aae1b0ce158bdc8a0
  • SHA1 1cbb185bafb72149abb8b9bd8b4c0cd1d87e6f01
  • SHA512 7fb8c23391a49ef7fdb31bc76f80cee37e576ce2d2617db1f03a16b3a52ed025360b62a7d2fcc4835de62e0eb60a12cc6f1e5dd439be14c4736f186db5393dd0
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon827b865e42181ecfba26ffee236fbb0800626be1discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2