Extracted

• • Target

    ccfdadcd4bd9dd07ccd30448d207dd9d

  • Size

    18.8MB

  • MD5

    ccfdadcd4bd9dd07ccd30448d207dd9d

  • SHA1

    dcb46dd2a9446489af64cb9244d36c138c653738

  • SHA256

    50e46868dec1ccf12f805464f0bdf31f87ca8e136b2921b7b067b5a76eb21b2f

  • SHA512

    88507e55b26b64a16d6d1bea824bd997eb4c859adc30660071607298b53eb0f1bfcc4c9a795248ad8d647438cc38e46ec82ee6aab969efb71cfdc1a34947ad1c

  • SSDEEP

    393216:zUIDoA1J6MFSxbz81bl5n1QMBIbzmE030vc6c2VQy:vD96M0FklVBW+30U6cwQy

  Score

  10^/10

  raccoon0343d4da493d263f78921a8724ca6adf05347cfeevasionstealertrojan

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • UAC bypass

    evasiontrojan

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2