Extracted

• • Target
    4c975dfed1a62a75bc8c35e7369c10a7d09cd8f03864a.exe
  • Size 483KB
  • SHA256 4c975dfed1a62a75bc8c35e7369c10a7d09cd8f03864af6ead9dfe6eceac3427
  • MD5 0385cf4826000d384e6340a27407219f
  • SHA1 1ed6362691e2fb4f112be291c97ea825abbbb607
  • SHA512 e5153ed352b35f0c631e6fa5eb5f9f35b4364d54c30b41bea32579fc5ce51e9a0fcacf163a4bf473c56adfc2e64c4cc8a9e862e3dd35979a8a6e07e89979b470
  • MD5 SHA1 SHA512

  Score

  10^/10

  raccoonfe582536ec580228180f270f7cb80a867860e010discoveryspywarestealer

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

    stealerraccoon

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2