Extracted

• • Target
    Intaller.exe
  • Size 567KB
  • SHA256 04157eb6cdd54ef10f305bb2feb43eafa0c0335dea91afd4c153101737fa3dde
  • MD5 241e902c0d538548be6b89a94771aa07
  • SHA1 697045281146a2e7dba7ec5ffdd587985e6adf67
  • SHA512 5367cbf8aa0ef9302037d8824f722fcdc7cca7789b7bdbe5bde217c904bd91a30fd3d00ee883c45db1b2c36583e881053f097dd50e98da14aeb189fa6e81e32a
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfd34ae8fb78d0554aa7caf12c271e01efb3342f6discoverypersistencespywarestealersuricataupx

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2