Extracted

• • Target

    NoEscape.zip

  • Size

    616KB

  • MD5

    ef4fdf65fc90bfda8d1d2ae6d20aff60

  • SHA1

    9431227836440c78f12bfb2cb3247d59f4d4640b

  • SHA256

    47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8

  • SHA512

    6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9

  • SSDEEP

    12288:1PQuO1JLx2auoA82iqOxdOc7XPkmpOw6mqc5m937hnTMktj1H:1PVqJx2auYqw7dOw6mql3nNBd

  Score

  10^/10

  raccoonee2a3d190100b91c20d8bc284238dda6evasionstealerthemidatrojanupx

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Modifies Windows Firewall

    evasion

  • Stops running service(s)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops Chrome extension

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1