Extracted

• • Target

    fdac2e9e28dab9d46d75e1a9d0463485_JaffaCakes118

  • Size

    2.0MB

  • MD5

    fdac2e9e28dab9d46d75e1a9d0463485

  • SHA1

    7b8cadc70ee00aeaf0f808ce608d9d1f2cf488a2

  • SHA256

    dd75325c7035eee20647ca9d5a101167165d2dba88f6bf54a7afc50c276aba90

  • SHA512

    46c968c932cbba65454197413385702425a61da8346c3562ffd3220637849e3670cc6814fa9c5ead1a48063990e7c75e7342f9ee7546f8d6227f817d78cf8b4d

  • SSDEEP

    49152:H7YMArGklBn1sel23vbqNsJfz1WnVcihBMVcEzx116:lKBeU23DXEjPCx

  Score

  10^/10

  raccoon3b4a989d02bdc16a530ec640920b824fdcd15ec4discoveryevasionstealertrojan

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V1 payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2