General

  • Target

    d8a2045665b6481d5f54ed0efb7bf2cc188a828da343439fe5833c2b320f40a1

  • Size

    403KB

  • Sample

    201108-vemtfhdada

  • MD5

    f2bff0caaf6bed815e16c33bac216282

  • SHA1

    b432a05c8cc8ef2f51ed02a79ef6c3580bd1db25

  • SHA256

    d8a2045665b6481d5f54ed0efb7bf2cc188a828da343439fe5833c2b320f40a1

  • SHA512

    e1fa818ffbad0f81ab51f1db4d401233c6335beeb735504c5db56338780779e4dc98158647a21afb2e4100e7f5b48fbffd6b231feaf30abc89d6253e9f9e2ceb

Malware Config

Targets

    • Target

      d8a2045665b6481d5f54ed0efb7bf2cc188a828da343439fe5833c2b320f40a1

    • Size

      403KB

    • MD5

      f2bff0caaf6bed815e16c33bac216282

    • SHA1

      b432a05c8cc8ef2f51ed02a79ef6c3580bd1db25

    • SHA256

      d8a2045665b6481d5f54ed0efb7bf2cc188a828da343439fe5833c2b320f40a1

    • SHA512

      e1fa818ffbad0f81ab51f1db4d401233c6335beeb735504c5db56338780779e4dc98158647a21afb2e4100e7f5b48fbffd6b231feaf30abc89d6253e9f9e2ceb

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks