Extracted

• • Target

    ff15d4b5791553472feda624bf8f7f2acc6f9889591d21785a2a4f00e63cb40f

  • Size

    385.4MB

  • MD5

    db20dc2b6cf644ee63b7420d7573faea

  • SHA1

    107403769cc759179de3f3228744da9efa9e321d

  • SHA256

    ff15d4b5791553472feda624bf8f7f2acc6f9889591d21785a2a4f00e63cb40f

  • SHA512

    342759564bdb028f1c5a44683047bec1a6ed10c04b35d3d7933dfb2eb9bc22f59399ed98c9dcd77cbe727357d4f981b820c90ed9a52861d01f3aace9974cd4fa

  • SSDEEP

    98304:q8JKGg+7VGUqKjsMZI5T/NKqsuJmnZylgG+ooDevcmP1fw3xLCZMMY:BJy+5GUqx5wqsHXe7Ppw3lr

  Score

  10^/10

  raccoon8eb14caca01131f5f4ff62ef8a0fcab4discoveryevasionstealertrojan

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon

  • Raccoon Stealer V2 payload

  • Raccoon family

    raccoon

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2