Extracted

• • Target
    5C247288DC99B426FA311A55ED2B47DC.exe
  • Size 516KB
  • SHA256 e4c826244f01a7c81d9fa83e0aed1e783714abd0556b663777bc5d8760f42c99
  • MD5 5c247288dc99b426fa311a55ed2b47dc
  • SHA1 0dd1695ba344a199c79211cc0757e020974c30bc
  • SHA512 14cced762634a69849f06b9e87315b085945838b410ef0e05554f894c8b1229ad648ca1724b8b042ffbb772a9ab49f01340d1fc0858ae54c3db1e127f73f3266
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2