Extracted

• • Target
    b6bc146e7e2f88afc9b81dc6cb4e4c54.exe
  • Size 429KB
  • SHA256 8ea7e098522cb46482fad73b8abf73f6c74f85d5e42953eb5353d5bfeb9497d0
  • MD5 b6bc146e7e2f88afc9b81dc6cb4e4c54
  • SHA1 dbd03a9b751c8aadad427f11840faf58e82b0fc7
  • SHA512 ed1c9d57915cf34d7c871cb4347d1c8f33d4be1debc99777423a1b5014dfb5e7cee8c4ba22427acf3023ac4c4339455b7801cf4a0b040f5cd50b9ae1441fcd4f
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonbe17623a7e46bbe6227e16dde04d43b81a77bd4bdiscoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2