Extracted

• • Target

    svctask.exe

  • Size

    179KB

  • MD5

    37f5d247d6003592fa8092d5defa4756

  • SHA1

    83ccbe599c2c25e563a9cbca883ed0576cb77030

  • SHA256

    34266fc97d6067f4f7348232a79612f907d5eb7ddd01bf5bbdab95e0631c6a23

  • SHA512

    f09d14d56718a08bd8eb93ec8aeafab4ca0a40cee3e52e766ebe8c87dd248a30f24b61ce49242e9b2306c80e5bbeb784bf61f8fad4051b6afef847a302d8b235

  • SSDEEP

    3072:ZM84rK+NLSAd7FPJCQ7Y6f/r9IZmZCkWAxCKU1SRwkBjSd5:KPuuLSE7FeZxkBSA6d

  Score

  10^/10

  raccoon4fe4637a73d298373737df144bcdd275discoverypersistencespywarestealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1