Extracted

• • Target

    1c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334.exe

  • Size

    1.1MB

  • MD5

    8569ef968c0c4045782e1ef4ecc96fec

  • SHA1

    6f59472c780116468aa2953f8286c89c3188457e

  • SHA256

    1c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334

  • SHA512

    4c9be25acce42fd404ad213cacc823d927e7c3249613771c1644a9054ff49e3edc0f4695240d067af49baf049546a2014fbe7966a37950c6d68d9f5c740e8af9

  • SSDEEP

    24576:pOlBrvlF3FneFqBtzaYP5M338gN2/viKO0jytcWRczjVTe+fUpy:pKnBtz7P5M8gcK10jyt9RoJFUpy

  Score

  10^/10

  raccoon1a5d06870a6b84740b2c11dce573e9a0discoverypersistencespywarestealerupx

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V2 payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2