Extracted

Extracted

• • Target

    PC-Set-UP_SOFT.exe

  • Size

    730.0MB

  • MD5

    06c4093950b292b57084643fdbef20d8

  • SHA1

    e9cfc6ef108e0e6ab1f33060a92bf91debd03bce

  • SHA256

    9484a44f677fc8ebd6dbbb9480dc039f3e799ca9f2381c580e1e3914b2b919f7

  • SHA512

    9b2d8b257982fc745fa8b5e906844ab54a66daf66f03f6482cec3fa584657270fd285ab15b6c9df19e44c29e52c7939c4d50e4de5683e9da0f6e886ce3eb389d

  • SSDEEP

    196608:Dqkq7xWxHjSwvcWgSNXqAK/9CHeB5DiWSzvkICfH8HryeuqKI:dxDSJQolfnDiW66cHzh

  Score

  10^/10

  raccoonf49765d62e02586d0fe162b5d3a934addiscoveryspywarestealerlaplasclipperpersistence

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2