Extracted

• • Target

    dfebde9ad6b1591c0044fcfbf6336cb9a9088409179055e4d438cd95b4d7bda0

  • Size

    1.4MB

  • MD5

    04367a86c2d056e9ae73ab1c36555b44

  • SHA1

    2c86756bc416f82919f6797d42977331ee44c5e9

  • SHA256

    dfebde9ad6b1591c0044fcfbf6336cb9a9088409179055e4d438cd95b4d7bda0

  • SHA512

    f77b69fcc463a10573e3e2630a9707f8f856038b3763f192e607f71b9eb4555fa309b86e4bbd7ed0e15552b234c5513c964811be030ad80d17d86f12cbe27d49

  • SSDEEP

    24576:sc8766GIxzD/8s0ZmzE3akj+qspLp2mmJWIB+mytyrmeIybBC:sc8gazDks0043spLp2mQsHmDNC

  Score

  10^/10

  upxraccoon3cc4b2df9390d71b3c4188a4822c2b23stealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V2 payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2