Extracted

• • Target
    2053102ffb18c971ebe3e63d29c65323.exe
  • Size 419KB
  • SHA256 2ab0d39053a25fa8336ce41373c842421255e6aba39b33e1d84fa36725546962
  • MD5 2053102ffb18c971ebe3e63d29c65323
  • SHA1 ad162b6a86bbb0b930712971b668e18cd3e150e6
  • SHA512 b9d90d634ef4686031be44ea81868e41076ce74275270b4ac10ef8262fdd725ad2a8c21a13c7154328b7134a4de5728b645204114fbf912bee332aa8dfab54f4
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon6e76410dbdf2085ebcf2777560bd8cb0790329c9discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2