Extracted

• • Target
    726725d8f044b6cdf3d98c941dc645c2.exe
  • Size 521KB
  • SHA256 443091dec2f1c3bd7070f668778ddda8c3d550d9dff0ae075ec6cf1273ee1274
  • MD5 726725d8f044b6cdf3d98c941dc645c2
  • SHA1 20b2c287656fc594d84176514f0cc080dc2a21f8
  • SHA512 84775d7eead6ff612832d11b7f880440bf22c60773ac8861b9701ef26bbc65c5cc086e422a439b4bff972db72ee8f077937da190e080e18130461678337ca2b8
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon8d179b9e611eee525425544ee8c6d77360ab7cd9discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2