Extracted

• • Target

    Setup 2.exe

  • Size

    726.3MB

  • MD5

    7b7f4c7bc7fe71ab3564b69a5e4c2a36

  • SHA1

    ecab2d3e3173beb712e0792ac747d30b65b72644

  • SHA256

    29912bee2ce5c51fabc43c5701dba06a44cb9cd2f591c099a9d53f69b6b7791e

  • SHA512

    645137903a35437c9f9ca2d1c0b9e832334d058ab69a6327590db73c611f148ec8c2ba9d910e0a4ed4e960f0b59a29064a40794cc21fa6bb0797f183217390be

  • SSDEEP

    98304:TDyBA2avWjy6U+ZbARvvGM/uCxDphFb/4I9xxTapkS9haR6IN9T9QfMrve9lS:tMyzWevz/fpbbprDRtveHS

  Score

  10^/10

  raccoon0dcbeb99ec1adc5c2b2b94dc1e3fd2c4discoveryspywarestealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1