Extracted

• • Target
    e8b5f09ad7c68d18049b74d7eef0ed5b.exe
  • Size 491KB
  • SHA256 27a502c17f81e1672e1d6cedd29376d3fa8bd20019788f733663b5fbb14097ac
  • MD5 e8b5f09ad7c68d18049b74d7eef0ed5b
  • SHA1 4fb7ad19c7e5f76b27b0f917fc67a83bee30ab05
  • SHA512 6d9c8e58011db17b8c5d2c3501d18abbbae390a352bdd0c280b79f9678a36afce17596de380d613ce64c7edeb8238a6ea9614b8ae566bba4105bd7fec0e61134
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon2ca527649af69320ce66ec133925fa5972569ad3discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2