Extracted

• • Target
    b1f940c8ab2f421e71d21f6a384077bffa86e00669d9c.exe
  • Size 504KB
  • SHA256 b1f940c8ab2f421e71d21f6a384077bffa86e00669d9c80282c54edd0aeefcf0
  • MD5 eb537ce66682ab64d2c82713a8dd9ef3
  • SHA1 df5b934364cf4376e95b9f05aefef0d0521119d3
  • SHA512 e8897c2bf32a430bbf62408bc574fb399ec697b19f980f9f5294e0bec07a756eaad30c8ed18f24cc6a7bfde7c08b8a49a316811b197c4508ee772d34837c6f6a
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2