Extracted

• • Target

    04c1ecaed917232ef3c8dfb885e8dda84d781d18.rl

  • Size

    168KB

  • MD5

    6643c64f29617b4e7cae474dc454431d

  • SHA1

    04c1ecaed917232ef3c8dfb885e8dda84d781d18

  • SHA256

    5dce0479f4adabaadf0faad5bf1478bb225787f3e1a7fc8d03495e0aed13b843

  • SHA512

    5c73d4a9567525679dcb64eb18134c61cc0f35572af711ba11e2abcbd4ff1bf987d3234057dbfb41796addcd07e87b425af21a6c6c52c692b4786936f85c39c8

  • SSDEEP

    3072:0Rb8x8w8spF105inBx3mTvld6Cge4Nkz7RSx/iQ46oE6Tv:0Z8Ow8GFC5W3mTvWChzlS41R

  Score

  10^/10

  raccoon970bd7b21ef58eba844bcc1b35da559adiscoveryspywarestealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V2 payload

  • Raccoon family

    raccoon

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2