Extracted

• • Target

    JaffaCakes118_d4ab23e5d1083c750f49a44ace8201025fc3d5a7752e52f9d939baac93b29918

  • Size

    734.3MB

  • MD5

    71d4aa16916bccdbc9bd8b644c3e6bc0

  • SHA1

    80d83af58f26d2602c32eb5f707def525777a9ff

  • SHA256

    d4ab23e5d1083c750f49a44ace8201025fc3d5a7752e52f9d939baac93b29918

  • SHA512

    0f390865942a640b2771529bf5db335a718f023e355e9938f6c483f08db003877e1e4b2e7e85ce05271ffb2e2783820660b5927800ea8b7288c633beafb4bf95

  • SSDEEP

    49152:PoNfVn4+HMH86lJsj8PL1/Pf98ORlp8E3kybEYcRc1WcM:7H8ysjMP1pRh0y4OdM

  Score

  10^/10

  evasionthemidatrojanraccoone1cf7b90a3d16ab28e5f22927e0db1c9discoverystealer

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V2 payload

  • Raccoon family

    raccoon

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2