Extracted

Extracted

• • Target

    2540f6f96c7686299fcd27c4e17a9191e107b4e65a7c32ed1d290775e96d9bd1

  • Size

    305KB

  • MD5

    3d638fa0a4c17eb3ebbef857da2b5dac

  • SHA1

    61ae2b4001950cb9b84dd49c5efb9f34596650a2

  • SHA256

    2540f6f96c7686299fcd27c4e17a9191e107b4e65a7c32ed1d290775e96d9bd1

  • SHA512

    08516729ac74a0160efac2df340b9d7d3bee8c0ea8c88cb79561849297e05aa706f4f88d9ed06cda6ac549eccfe563fa4a5f5c02f7969a42a0eea4ce23970fc5

  • SSDEEP

    6144:AB6EZp9bNAJIZMV3wqA1TjlE6iCIfS0Vnqd9u95nv21xBCwJ90G:AnTewTJEdCIfSYqd9um1xBCk

  Score

  10^/10

  netsupportraccoon1adeb438cd8ab2abb4349e0ca6853b53567d5bff28c2a18132d2f88511f07435discoveryratspywarestealer

  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1