Extracted

• • Target
    deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1.exe
  • Size 517KB
  • SHA256 deddab103a2aaae2ce26b6b3b1b1d263ac4c272584ec1d7d5ff8a96bcbaebd4f
  • MD5 cb2be9b44b5ccb320e6e6eabfbe3123f
  • SHA1 85a92fb7d922a4d2c51bac03fedc2868599f23b5
  • SHA512 e6a7ce063641002ac5315eecb2b11f0f4682d8144a81c26c49132c5a4dae2bd2e11ca83ef8a3ea6a8861097487b77c7fc8a60192686c2b79324eb6f8f624b0f9
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon56be4efb71b0a38de783d05b401b05f1bc805bb2discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2