Extracted

• • Target

    70afebe71346475e1f6d4a1c591f920f7ed1d055261eb5d6a4276831aef77783

  • Size

    2.9MB

  • MD5

    80958a4b85453f4df82ec131554a5412

  • SHA1

    44cefe96467895934ec9d1c2461036704c971458

  • SHA256

    70afebe71346475e1f6d4a1c591f920f7ed1d055261eb5d6a4276831aef77783

  • SHA512

    cab01e1d63b4ff9a8d35c48fddd18b0959068510b1ca0e66997ed2d59a34b8903f23d3b3736180b52130a325eda3665f9babe2dcad91308f16526e8812fee1c8

  • SSDEEP

    49152:jF50a6aPVOFMx3SmroCZscivbS6mqxEWoKmqZJffp3vSsqPU4eaw1GfNOmdxPXFZ:XroA7PBfDt1yOcqtd

  Score

  10^/10

  executionpersistenceupxraccoon1a5d06870a6b84740b2c11dce573e9a0stealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V2 payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2