Extracted

• • Target

    5573d5eb509dc3f68f674c95b3718dfb.exe

  • Size

    7.0MB

  • MD5

    5573d5eb509dc3f68f674c95b3718dfb

  • SHA1

    2d9e58b7c1f85355a50bb6fff7708be675d063c0

  • SHA256

    4715de346335933da6b30b66030d0c574bfe464f332c327424b861e401f30cb6

  • SHA512

    33df579b25a31aadd645e330196c973752362aa242df3bec56aec5528231440d034a1906f23d3a9fb8cc74c0f25b8e7a8fc38fce0f475c2c5cc4c9f13534b857

  Score

  10^/10

  raccoonb411699deaa52994b115ef42d0917fddstealerxmrigytstealerdiscoveryminerpersistencespywareupx

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer payload

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2