Extracted

• • Target
    FortMod 8.5.exe
  • Size 1.0MB
  • SHA256 6db1ae06db8883952d2eda1e87492ea0bfbadb8f76cc36d0dece41a9f02985a7
  • MD5 30af8b8655079ec0aafa5e08215d87ff
  • SHA1 e1bb9814c2b51b328ad3f7a770ba0432a7a4a1c2
  • SHA512 eac0b16ac26d0a77f6ebf4a688e8c872b0f2d34f400d93e71db9de2881781628b4a6f2e8910520bd61d32b7992f869af5bba4a1b7e0a529b980bd120c9133dbb
  • MD5 SHA1 SHA512

  Score

  10^/10

  discoveryspywarestealerraccoonpersistence

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2