Extracted

• • Target
    f8896e327cdf85749c94a832107c453f.exe
  • Size 1.2MB
  • SHA256 32d8cde15a3e57d033e2bad6e8e0d1a3a16f4934ca4c0df122cbc7d3a0de710a
  • MD5 f8896e327cdf85749c94a832107c453f
  • SHA1 5b3a73c7ab7f223737974e358865158dfd093dba
  • SHA512 ff44673ec6e6dc0b95f49e1d27ca97c99a322439288a9a5e1392ee959dc2287331ee02ad2fee403f6fdd49ce49ae6a74c697b41407a8c4b73668e979e69dbe4c
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon8d540643cc195ccd3e77766ab1d4b73d68715d8cdiscoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2