General

  • Target

    56f250ff87516864f403322468ad9ca43edd691bdc85a4f4e71a56bbf098c97b

  • Size

    403KB

  • Sample

    201109-6el35w4xzs

  • MD5

    6ef14f42ca06245a7ab3c2fa26dfbd94

  • SHA1

    c208b3467df10f1c491d0f6839003c9b199a0d18

  • SHA256

    56f250ff87516864f403322468ad9ca43edd691bdc85a4f4e71a56bbf098c97b

  • SHA512

    9429263934e61e5be84f1c7e141b4ca787ec63fd680064b5b5f8069a5c5f50d6b869456e9eb40218ece107c833e6c71fd593d9e4c768894e543c05eea554d4df

Malware Config

Targets

    • Target

      56f250ff87516864f403322468ad9ca43edd691bdc85a4f4e71a56bbf098c97b

    • Size

      403KB

    • MD5

      6ef14f42ca06245a7ab3c2fa26dfbd94

    • SHA1

      c208b3467df10f1c491d0f6839003c9b199a0d18

    • SHA256

      56f250ff87516864f403322468ad9ca43edd691bdc85a4f4e71a56bbf098c97b

    • SHA512

      9429263934e61e5be84f1c7e141b4ca787ec63fd680064b5b5f8069a5c5f50d6b869456e9eb40218ece107c833e6c71fd593d9e4c768894e543c05eea554d4df

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks