Extracted

• • Target

    CA9BF1FDF967F8F859646098B06970C85907228F2767F.exe

  • Size

    2.7MB

  • MD5

    916e98f8de39ebb4272782de0d79b20d

  • SHA1

    cf8f1d1d80b2a05693994d5a5d4d362e8c5a272e

  • SHA256

    ca9bf1fdf967f8f859646098b06970c85907228f2767f613a8622884ecb16612

  • SHA512

    a9ce8a8f8676110354cd4de785b6c4c455ac4c4ae41acba41575f2d5a1ee17e4d763281ea6107457680196ac1ced3f5a80ec4c794e5c462c18cb5ce9a055a0eb

  • SSDEEP

    49152:fZTmOKzejxEfav+cv+WD1NrYG2812Pwm3bUEERJawyYTG:frKz/a2cWWpNH2811+pE3Ew

  Score

  10^/10

  raccoon1c2981de60c0167871c96a32a107ba2fevasionstealerthemidatrojan

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2