Extracted

• • Target

    56953f00e527964f9556247cfee99e71

  • Size

    8.6MB

  • MD5

    56953f00e527964f9556247cfee99e71

  • SHA1

    460f2e879f6b32e2917a38f20478491da003e971

  • SHA256

    88d0b7c12318d56331734f2e0f9c40d5aae3b35458d78b9f50a5f588f37315ec

  • SHA512

    fbf82b42b782eae11425c1be23f60bdc7bb35b485386ef7082d0fa0da584133af884932d4e1513dabd8909ab83a598b0096af76cef7024fc04cf4fdbab24d311

  • SSDEEP

    196608:sEH8sDE80CzUqgX91QRWpabS4TmOePf6oX/b3xXJKV1PBK3r8BAs+nnaqmU:uq7z8XsRWwbSHLf6oThXE1iiA/naqmU

  Score

  10^/10

  raccoon0343d4da493d263f78921a8724ca6adf05347cfeevasionstealertrojanupx

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • UAC bypass

    evasiontrojan

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2