Extracted

• • Target
    ad27c002c314717f78cadab27bf049cf.exe
  • Size 768KB
  • SHA256 ceb6b3d9b2ae0430495caaecedbdd494ff5cd44cb24780cbbb2863efa9386182
  • MD5 ad27c002c314717f78cadab27bf049cf
  • SHA1 8467513920df45cc742760f05fef909b54a95261
  • SHA512 a691790f69341f28173e6a83200480af952ca35af0724d670d8b4a52264c991cfb61ee6cc513615414a2864071244753b84122d493a67f2f73d47a2395e5255e
  • SSDEEP 24576:gbGdMU29P/8RLgad7P3BeJlDff4WGVF9kkzB:qG+xsZgg7fMJlDIVFTzB
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  raccoon4076618ff41b7d8c15ac86f265ebc66dstealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V2 payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $TEMP/Designation
  • Size 209KB
  • SHA256 5ff84c86bbb50331fb0a8dda84591ff259d236aa54fb1c7e14e420e916d340cc
  • MD5 c1cc1aa18b9007c18d77d379897ca025
  • SHA1 64c85a49243812f66e0dd819129cb99ee10ef763
  • SHA512 791c7cdc14c4947460327d9cb4b9a524dcf948ece3f96446a0d8da8cd938922dcb5695a16b011ab7910581341ca1b0088dc1df7f45712dfdcb78a2058d56c310
  • SSDEEP 3072:J8NRCzqq/gNDCFPqWvMh5h92CjBf8QUnxoBVp:J8NRCzE9CY3h5h92QWQUxGp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    $TEMP/Prev
  • Size 173KB
  • SHA256 d4dce3c852197709b13ad7a426d2e515d3d7d0d52d79d4b1de7f3c8e5f881ff3
  • MD5 8d019b45973901b4854eec33096d05c0
  • SHA1 1dfb37a78659ba3917c6479ead9c9f645bbb8331
  • SHA512 9e23a4d76c707476e0c342dc6468c153571a5e1a106397d80c8ade95682119bd3bfe45ba803521327d61d926c14bcb3b61fd1869de4881956453a53183e98af1
  • SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCWlrss4M5iRq3U0Pe3vHU4Sm:LQBk7JjX74cN0lrztgwU0Wym
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6