Extracted

• • Target
    f496b1e5f8cddecb0f7524d1d417142d4d70fa0d80567.exe
  • Size 575KB
  • SHA256 f496b1e5f8cddecb0f7524d1d417142d4d70fa0d805672c92008e20e943b3a8b
  • MD5 52c2f20abeb8aadefcc00589b5840e00
  • SHA1 a286c5c120d1084c617d2d22ed6639b2a740373b
  • SHA512 4815b14e2c2e3e25b3122fed8c6f26949421482ae63df50d5235213d37be04bdf99f4862b981475ea1ac3b1ce24ee4dec708cd71a015c284b9d1e62425837897
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2