Extracted

• • Target
    DD82037FFC85850A40B6C6561EF03ECB.exe
  • Size 5.2MB
  • SHA256 e97f71d3020b3cf4c3d22ebe380a902fddc0e5ce666cc1b0059efe8e67860a72
  • MD5 dd82037ffc85850a40b6c6561ef03ecb
  • SHA1 5e6078e228d3e53ffa6784609c0080bb9c48ae88
  • SHA512 dbb5029d2dafbec96ff39a2fa3eda85d2c58902e3fec0886b69f2b60a7571d360ac334aa76ce68638aa2d293883952b1b2afd07d1493e06e320f174a13564b18
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoona1c0266f96533c41e908a3cd326d2773b7b683e6discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2