Extracted

• • Target

    AdobePremierePro.exe

  • Size

    715.8MB

  • MD5

    6ef8e38116dd5be6d51009fcbd8a8bf0

  • SHA1

    d88e519d2f843eafd31f902d0530c008aa8daf51

  • SHA256

    1517a5834abc8af4da1864e28a222837da00cfc8cb5cd0cd1c0110580209c727

  • SHA512

    84cf126d6ee471b2df1f6479fa06dfabbfa41f8d320db40b87ab98989f659d166b3410999054e9974d2526dd7c6105ac319fc2a960c5b7ba5ae05f4b8abd1240

  • SSDEEP

    1536:9rae78zjORCDGwfdCSog01313Ns5g531FECUA9lReMbP:TahKyd2n3165m3kfA9veML

  Score

  10^/10

  raccoon8fb7b851641d456f39570978e99f780epersistencestealerdiscoveryspyware

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    port/cont/rich/kaps/unbcl.dll

  • Size

    1.0MB

  • MD5

    75beda2b1a92744dbb05878e4491dde4

  • SHA1

    50e01b391b711c92046183a28df3eb0e92c29128

  • SHA256

    b6e98f66ae143bc38e5381fa8c0d99e58434169f25202e520664419c2b35412b

  • SHA512

    81359115deac81e540a1c6f95b6ee8bc57adbc7e514c5c997dcd05e20333ef3b6f52214de74bdc7b55471cfd7be5fb53dc1712cef416b7e9037d030c6c7a2b5b

  • SSDEEP

    12288:UpiYCl2vyrqmx32Mfban+AYMTkgWOS42xGeyz:yiYC0vymu3rbGiMT5WOS42xG7

  Score

  3^/10
  behavioral3behavioral4

• • Target

    port/cont/rich/kaps/winsetup.dll

  • Size

    3.5MB

  • MD5

    b6a2e94c56a141b004e400358e72ce79

  • SHA1

    fe3a749812c0014d7810b4bc5e2f849384cd9e31

  • SHA256

    2b40132fa4e1c3de5e70d57935e2c99de437f69ae934a70243dae9a0ce3ca6c2

  • SHA512

    a31dce366e5d1a53821ea4db01d3f7b1924be9bf5c8e0ab74aadf48c1b6f85d4c7656eecfc0bc9cce915b765589b4bb9c324dce21ae5eae1f4f8774bb6b282a3

  • SSDEEP

    49152:NHSWbyqeCs3pbW5O/hPMiyYbR6BjG0eFHt6Hfp9pt8/s2tyml418:I/6dYbR6e69ncymz

  Score

  1^/10
  behavioral5behavioral6

• • Target

    port/cont/rich/oope/MBR2GPT.EXE

  • Size

    1.1MB

  • MD5

    4bfd587c99fe34eea0e74622c798b3be

  • SHA1

    39309fc62dadffb36a6ee75de6194121be206728

  • SHA256

    5a54bb94f6756deafc0bf25c9eca4e9dea00ddc3af293479bc7c3380f1be30ea

  • SHA512

    f5ea0477c1c1683fc8c9f5fa7d5071ffc276f4cbf5f9b78dd9529cc20ca0905a60a123cd82bf5ac26f1b83ba0c732c5d9ca8b336275d799a8518179cb0c5adc3

  • SSDEEP

    24576:h6kHNg53pIE1OJmPJQ3IKxw9EdE+1Hii1:h6UGpAmcIJIZio

  Score

  1^/10
  behavioral7behavioral8

• • Target

    port/cont/rich/oope/W32UIImg.dll

  • Size

    2.8MB

  • MD5

    f3997597c98028d1f72e431fe86bf86b

  • SHA1

    061207c2ea0b449a4fb73e15e43d49c37c22d802

  • SHA256

    3ab6dba6eaa7f19e4e0ea4b07aed1e3ae9662a091648bfbf66f7fba0f436c321

  • SHA512

    2392a281c5ad546cf0acf4e94c5d8e535de4f34063fb9e47867297ec5f3297e5c551e1d764b3dd1357756cc6c5263acd26fa86968b903f67ad2dfb03b93ffb89

  • SSDEEP

    12288:quSqSvMTuSqSvM6agvGokAAQ4UPTyiJVI:quSqtTuSqtT0RK

  Score

  1^/10
  behavioral10behavioral9

• • Target

    port/cont/rich/oope/W32UIRes.dll

  • Size

    208KB

  • MD5

    2819767cd9b7f93238144c4b3abb97d4

  • SHA1

    2a303acc5ff85a58d2aa1d1b7fdc2077e430b331

  • SHA256

    36fa6e3c584a9d03d6063c10c218c2090498a6885de8e3d023867cb849129550

  • SHA512

    6df3e8b07ae730f24217aeaba03ce97858aab4142bbda6025353d9ffaea2615ab4531143c61c6b2cd68ae19f71156efd0d5fe24e036b498cacffa52609c91f1d

  • SSDEEP

    1536:FkzzzOMdAV8yEyePaauLXLbfm2Xp0jcM2qKMtzgeO971OuvQwyV/PcBpz+:6zzzOMSLnKuwUePuvQwaUra

  Score

  1^/10
  behavioral11behavioral12

• • Target

    port/cont/rich/oope/mispace.dll

  • Size

    3.0MB

  • MD5

    266194e2736b2a7c190bc5da47ec9a7a

  • SHA1

    d48f34acff6173fd061ca8e79b1f008e900bda94

  • SHA256

    efd677146e0cf80583dcd466e2ecf1c8c3ed58d0a502a4f306a6d414ac80e2e4

  • SHA512

    7a90f1eab18a87d5211d96caaafa9fa7930d70e23cee3dde1b569166dce86b1aa62ad755fd79205ac4270c8af2e1b834a639ef95187fe860574873959d97a7f5

  • SSDEEP

    24576:AC/2Yq4Ggm7t08aRsxBX5OJwma0UjrYAaCDmNz8W0uUEfTBH4LodcadX7e:ACukGjYaTrc8mexUfTBH4L8Xy

  Score

  1^/10
  behavioral13behavioral14

• • Target

    port/cont/rich/oope/msftedit.dll

  • Size

    3.2MB

  • MD5

    ad8d5b57063dda8523c2f653fc8e93e9

  • SHA1

    0d59f82d22d0f483f4553681a89e0f5bb533f944

  • SHA256

    b458aecce93656141538b2aab988e382ce8d6b376a42b05313b701874a4c2e55

  • SHA512

    417dabf27b5761692011ada6a5c87e13953d58e2045c985a9a45825be2cae5fff9246e2b0708875a4777cecf75c2628e9dd56616466e15b1fd0153dc39af78b6

  • SSDEEP

    49152:Sl6/Qm3K8bGgu0K3IBnlOq3lrUCBmLUI4oPSfvKqXPeh3ZNwEsoYb9wX5zonj16T:TzS+lBU4oP0Ze4+

  Score

  1^/10
  behavioral15behavioral16

• • Target

    port/cont/rich/oope/msoobeplugins.dll

  • Size

    1.1MB

  • MD5

    b165f259cf4d1d25bbdffa1cc676dfb6

  • SHA1

    4277abb99956e8ea1517f68cbed19292240a93b2

  • SHA256

    d19748fa57ab5f4692fb6e19a189caf72be3754227acfde7d6cc9e3712480465

  • SHA512

    fad6a857f2a96f387f412713268eff2cd2338c5bfbd98a75a237d7e93def9d3225f7bed2abcb2b84bd9aef626a9d4d6bb1eb22eb2d1fcd5ce9bef9fffe452ac4

  • SSDEEP

    12288:REadEKSpoTMRwvzgi5e7oxEu1HoYV8UqK8Q7YatVswMkw97:RTLwRNi5eo6co89qBQ7Yh4w

  Score

  1^/10
  behavioral17behavioral18

• • Target

    port/det/DMWmiBridgeProv.dll

  • Size

    4.2MB

  • MD5

    e246609fb36a7acf63392533e48c285e

  • SHA1

    99dea381d15b2af7e68cfed5f9d75c33c8be8a12

  • SHA256

    ef7da20805406961052d0146cec2c7f1b5ba4db17a114e15a237f33e5768e7cb

  • SHA512

    e29279134cf4b81fde4bdba36c484d839eff3a2a7ca191d004e984e847488441b97b4830d3198149f26d54e3d1bf9e3cf4e29d58008e0c3b1876c057463cd6a5

  • SSDEEP

    49152:aRA/BFSzrERnqG8eHH5UmdSqr2KjUQqTjU/4xFcGw:aRQDUSr2q6Fx

  Score

  1^/10
  behavioral19behavioral20

• • Target

    port/det/MSVidCtl.dll

  • Size

    3.3MB

  • MD5

    6a93c400f7d5bcf8799c0506531f7d12

  • SHA1

    f8ecd93adfc87ae76970656bd15af3a960a83428

  • SHA256

    6679297f7e7f17ef37f48fa25f070d78e76324d167aa8b961d85327321e58754

  • SHA512

    209476a382bce5b53762b52c5b9f3f1bcb0d1f3b3763d1c8aa3ed6c1af838d4b442ffd7a40eb851a6c36a462031ee5fda5617dae5348426f7de3ef73b2aaec6d

  • SSDEEP

    49152:GRVfgoQrkv0BzBQLW6Ki8gT3lZhrnxySgnpO91MmIusURfvxmtdl:GRVfgoQrkv0BVi8gT3r9xyS1jzfvx

  Score

  1^/10
  behavioral21behavioral22

• • Target

    port/det/migstore.dll

  • Size

    1.2MB

  • MD5

    6edfa6fee4f91d989f0c95add39013f4

  • SHA1

    c7e06bc42d0b9bb318aa604c7f8d009be3c4718a

  • SHA256

    acb06cf520fa85c3929645c88d99ceb454bad6a9cb9642097b4b9b8a3504d4bf

  • SHA512

    d6ff5655e9d434ea881072452a22d9441a3214d6ad08c16d5abc124ff569b0fb6b7deae0ffa8834486decec2247c92950d4d6baacf72ca87d45dda25ea6eb120

  • SSDEEP

    12288:AEQz64gymq0bj97S1JzTtYZF1oj9JOx3CxGlEEbxdpU+:AEQO4gymq0bj97S1VGF1oBJORCxONo+

  Score

  1^/10
  behavioral23behavioral24

• • Target

    port/det/msftedit.dll

  • Size

    3.2MB

  • MD5

    ad8d5b57063dda8523c2f653fc8e93e9

  • SHA1

    0d59f82d22d0f483f4553681a89e0f5bb533f944

  • SHA256

    b458aecce93656141538b2aab988e382ce8d6b376a42b05313b701874a4c2e55

  • SHA512

    417dabf27b5761692011ada6a5c87e13953d58e2045c985a9a45825be2cae5fff9246e2b0708875a4777cecf75c2628e9dd56616466e15b1fd0153dc39af78b6

  • SSDEEP

    49152:Sl6/Qm3K8bGgu0K3IBnlOq3lrUCBmLUI4oPSfvKqXPeh3ZNwEsoYb9wX5zonj16T:TzS+lBU4oP0Ze4+

  Score

  1^/10
  behavioral25behavioral26