Extracted

• • Target
    e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43.exe
  • Size 522KB
  • SHA256 e6571c9ee5508a3a15a186c993d9e13ff43b0c0874d43db45dbead81d280c58c
  • MD5 f545d501be333e5a1ba5bdbb404b031a
  • SHA1 80e7545f558c2656ececf3ee2f94795b1b7b84ac
  • SHA512 abb83b28335ce6a2433648fc0b57deb09a932006b6c564b876ef89157f2426b4eb90ba31b0b4faac30462c0b7288d6964e9e9b41ccce6e1c756b53c6fb4ab57b
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon56be4efb71b0a38de783d05b401b05f1bc805bb2discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2