raccoon | 97efb8b6fc0c9b84e02a02372ec9e6b0bfb95cadd63d9941d7815d58adc5849e | Triage

Resubmissions

27-02-2020 14:32

200227-j9j97brmwa 10

24-02-2020 18:10

200224-72rcb5pv46 10

18-02-2020 14:57

200218-ab6jp3b1nx 10

Sharing

General

Target

97efb8b6fc0c9b84e02a02372ec9e6b0bfb95cadd63d9941d7815d58adc5849e
Size

637KB
Sample

200227-j9j97brmwa
MD5

f8e8da4bcb00ac0f4c52392719c7361e
SHA1

accedfe263fca73d78eab360f7afe9d131b062bd
SHA256

97efb8b6fc0c9b84e02a02372ec9e6b0bfb95cadd63d9941d7815d58adc5849e
SHA512

aa3614c91419afdcfb7f8ae0bc603580289434d439d0f6fed31c5ea4ab97ba7beb5973f7560f4f12ea0bdf5cea842ff84cf8f587b7bf79e182ba378df22a07e5

Score

10^/10

raccoon 89379f5371f470435351b0d002d50f28a65fff02 evasion spyware stealer trojan

Malware Config

Extracted

Family

raccoon

Botnet

89379f5371f470435351b0d002d50f28a65fff02

C2

http://104.155.44.42/gate/log.php

Attributes

url4cnc
https://drive.google.com/uc?export=download&id=1jN5ZmsLRZEQEtxsUIIVXnSOKaqBdnX6Z

rc4.plain

rc4.plain

Targets

- Target
  
  97efb8b6fc0c9b84e02a02372ec9e6b0bfb95cadd63d9941d7815d58adc5849e
- Size
  
  637KB
- MD5
  
  f8e8da4bcb00ac0f4c52392719c7361e
- SHA1
  
  accedfe263fca73d78eab360f7afe9d131b062bd
- SHA256
  
  97efb8b6fc0c9b84e02a02372ec9e6b0bfb95cadd63d9941d7815d58adc5849e
- SHA512
  
  aa3614c91419afdcfb7f8ae0bc603580289434d439d0f6fed31c5ea4ab97ba7beb5973f7560f4f12ea0bdf5cea842ff84cf8f587b7bf79e182ba378df22a07e5
Score

10^/10

evasion spyware trojan stealer raccoon
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Modifies system certificate store
  evasion spyware trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionspywaretrojanstealerraccoon

behavioral2