raccoon

General

Target

9a31a01f8e6fd171bc5e6bcdba4ef0c4.exe
Size

1.0MB
Sample

200710-n9mrtasmbx
MD5

9a31a01f8e6fd171bc5e6bcdba4ef0c4
SHA1

6bac9e69835450235fa6ff9580f3c35a46df526b
SHA256

2474c1ce1d299fd2234e7b10f6e464861151bf53e68f15a2a944dbeb56e5e0e9
SHA512

d162b78512cb5890fdb42c7ae595c10fe37e362d733d1d9f114a1fae6aeec89fcfd3458dbc2d879c48710d04134a877d7bfea01b031a79e0b528a9d1157aa71a

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\LocalLow\machineinfo.txt

Family

raccoon

Ransom Note

[Raccoon Stealer] - v1.5.13-af-hotfix Release Build compiled on Mon Jul 6 14:33:03 2020 Launched at: 2020.07.10 - 07:10:32 GMT Bot_ID: 58B98E61-8F0C-4164-9CA8-CBDF20304A02_Admin Running on a desktop =R=A=C=C=O=O=N= - Cookies: 0 - Passwords: 0 - Files: 0 System Information: - System Language: English - System TimeZone: -0 hrs - IP: 154.61.71.13 - Location: 37.750999, -97.821999 | ?, ?, United States (?) - ComputerName: DJRWGDLZ - Username: Admin - Windows version: NT 6.1 - Product name: Windows 7 Professional - System arch: x64 - CPU: Persocon Processor 2.5+ (2 cores) - RAM: 2047 MB (424 MB used) - Screen resolution: 1280x720 - Display devices: 0) Standard VGA Graphics Adapter ============

Targets

- Target
  
  9a31a01f8e6fd171bc5e6bcdba4ef0c4.exe
- Size
  
  1.0MB
- MD5
  
  9a31a01f8e6fd171bc5e6bcdba4ef0c4
- SHA1
  
  6bac9e69835450235fa6ff9580f3c35a46df526b
- SHA256
  
  2474c1ce1d299fd2234e7b10f6e464861151bf53e68f15a2a944dbeb56e5e0e9
- SHA512
  
  d162b78512cb5890fdb42c7ae595c10fe37e362d733d1d9f114a1fae6aeec89fcfd3458dbc2d879c48710d04134a877d7bfea01b031a79e0b528a9d1157aa71a
Score

10^/10

ransomware discovery stealer raccoon spyware
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Raccoon log file
  Detects a log file produced by the Raccoon Stealer.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware
- Checks for installed software on the system
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Raccoon log file

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Checks for installed software on the system

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2