Extracted

• • Target
    f91032bdf9ce88ba2dae2f87bb73aa20.exe
  • Size 491KB
  • SHA256 3a0f8c1614f5d797d81a89e08490bf5af5cb1ba767c1610e8a2cf52661e20517
  • MD5 f91032bdf9ce88ba2dae2f87bb73aa20
  • SHA1 2623d0b1df54c6788b79f19061325ac6fa7bb7d0
  • SHA512 f23c0d3759a938fea16259832c5c21d9514095d47279c1eb6552c3623265c9794160d0bd85862f5079da144066412400f47b964c27eb87014348d15256c3c217
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon6e76410dbdf2085ebcf2777560bd8cb0790329c9discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2