General

  • Target

    e93548a1cbb3688e11b0eb6d4682ceee5df0ed380c703133b9f3e7455b8405e3

  • Size

    403KB

  • Sample

    201106-wyb99lkt9a

  • MD5

    ecfb302b469218cdb9806aa24229a73e

  • SHA1

    317ed53f41dd3e88fa6db2b36c0454391ceab8ca

  • SHA256

    e93548a1cbb3688e11b0eb6d4682ceee5df0ed380c703133b9f3e7455b8405e3

  • SHA512

    8f37ef7a5565059bb2aba9c5a4be838ebc50a8c54b0afc70571b05d15ddd47fe9d0eb6412bd51eee02f1076bff388ea70397d7ab310bd55ea736c043944c90b2

Malware Config

Targets

    • Target

      e93548a1cbb3688e11b0eb6d4682ceee5df0ed380c703133b9f3e7455b8405e3

    • Size

      403KB

    • MD5

      ecfb302b469218cdb9806aa24229a73e

    • SHA1

      317ed53f41dd3e88fa6db2b36c0454391ceab8ca

    • SHA256

      e93548a1cbb3688e11b0eb6d4682ceee5df0ed380c703133b9f3e7455b8405e3

    • SHA512

      8f37ef7a5565059bb2aba9c5a4be838ebc50a8c54b0afc70571b05d15ddd47fe9d0eb6412bd51eee02f1076bff388ea70397d7ab310bd55ea736c043944c90b2

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks