Extracted

• • Target
    17154ce0df2477a9caa57a2fc9ade12f.exe
  • Size 502KB
  • SHA256 23e90f7107a6965ebfaf5fcf719feb3fff0b41747a8fd46713ac7cbef4535dc9
  • MD5 17154ce0df2477a9caa57a2fc9ade12f
  • SHA1 1c5d885911a82eef7bca53dd4f2b90b6af410c01
  • SHA512 7b1528c01718dfa13c1448c67397c6bed745846ce170cb5f1f7f452941bc9fe117519b9cd4e0608ff444d0172bd34ae50bc16edd332dc96e448018db36f0b09e
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2