Extracted

• • Target

    4559bea53ae91e2268d42570d6f38b69.exe

  • Size

    2.2MB

  • MD5

    4559bea53ae91e2268d42570d6f38b69

  • SHA1

    059f39c4becc99b10e4b095dca3094a61c8de575

  • SHA256

    6ee825dd6d1382f588985abaaf023a0204f005a8eb6a53952a88ee71ad6b7221

  • SHA512

    4ea30bbb44eed25bc7bf3e4959284c215a1067c7c5aac9ba16d6463524662864b2aebb9d0cca592bfb7ee861957b8076410c8cad42655b0cd0fdc46ebc44b962

  • SSDEEP

    49152:pzdjekKQ0uumLL27hoFWcGnVjFajjIwTsSKuZsE9fm/mITWF0a6LClFs:viLSugSdoFsjsjMgfKuZ23TpClFs

  Score

  10^/10

  raccoone4069b8c4993c296232585045074ce47evasionstealerthemidatrojan

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2