Extracted

• • Target

    0f0fddacabc294b1f3497b9b97142d0b85e30d2acb646123ac122601c11e7c4e

  • Size

    366.3MB

  • MD5

    82793f75388af5ca540609250ccb2397

  • SHA1

    fe8b0155d2f3cc258aa3408ca75ce396c6a67a7d

  • SHA256

    0f0fddacabc294b1f3497b9b97142d0b85e30d2acb646123ac122601c11e7c4e

  • SHA512

    10b96eb816086589cd80cc097dd3bfe26ad1ff079e0b86e564d4209ec0b7462efb05c926a8c868dc0bb4bb6b4ecf32128def534e749cfd74bef84053bef54b08

  • SSDEEP

    196608:EWntYI5uLBn0H2j76BG3jEd8jquepipoO:EWh50WueA4dlueoH

  Score

  10^/10

  raccoon7cc7e20e8fb40a79ad7a928b913d97acdiscoveryevasionstealertrojan

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon family

    raccoon

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2