Extracted

• • Target

    2AB36B7875F2B5A876377164B3B609F2.exe

  • Size

    2.9MB

  • MD5

    2ab36b7875f2b5a876377164b3b609f2

  • SHA1

    0d022cf7d49015fc97c576d89a710e5aeabaeaff

  • SHA256

    0f8e95a2c0575292fe6b8151428013f85b645f315e2d67a927a4b0c6d26af3c9

  • SHA512

    e62f221b3e3a7d2d14e56519ca46e69af3c2570d8d2d9cc382c9778fe37a75567b3af311074ed1709a0385d9bd38e11dd2ed8dbd1b30427b53d56266fe486238

  • SSDEEP

    49152:ueG4DbBlHFAYl0R2fvjnZ1tmr5BOFGdoYNStv4Qr/0O0NAfT6ZI5I7+SPqKSM1x4:ueGUGAfT1e+hKhDPa

  Score

  10^/10

  raccoon4a9f651f0c883b5f75c545d430f6c021discoveryspywarestealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V2 payload

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2