Extracted

• • Target
    a4770bca912ec8bc41db7c8ca0603248
  • Size 444KB
  • SHA256 abac1d73d13e6decaf8216d4503cf0835a48afa117e9fc9dae92a1fd10f8a89b
  • MD5 a4770bca912ec8bc41db7c8ca0603248
  • SHA1 981d52eb1c1217d8615453be5c2578f41697ed49
  • SHA512 95e693af39585ec04b97fe516e5728b93a79004f144accda497d1b243a8be1c2a7c3e4fa28817d3ddee5abd1fcb26b4827e8e89e50ddc7f469e1e9dc7c2326a2
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoon8d179b9e611eee525425544ee8c6d77360ab7cd9collectiondiscoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2