Extracted

• • Target

    setup.exe

  • Size

    6.7MB

  • MD5

    7fdff809af7d3b25c76709165a78a89e

  • SHA1

    6a62910a88111aad6a22924a8e1d1a35626f6bee

  • SHA256

    e1689f695b580c88f6b58274cfed905541749bd86f9f3cd95b70ae22387313ca

  • SHA512

    925fbf207a628989230ccbdb16e41eb8a54c9df801e05f4a3ee71d8f66557e97fdef7453b89f50f73d8ef812edb7ff43178a367a4f1f67b901ef1972cb35f950

  • SSDEEP

    98304:yQG23fmewHtW7ZgPsy8WtNyDqmNiRMkJlSqxegWtIoZv082OQvG5N8pbso2x+x:jaQy86+iRM8EIegG/ZvhWrgj6

  Score

  10^/10

  raccoon417f00e313b534b6267434933616178bevasionstealerthemidatrojan

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2