General

  • Target

    0709ab8fe8219be3c9d28dfa854db90eb1d9a73bff98da2f4b62273f4f68bfee

  • Size

    479KB

  • Sample

    201109-bpaapfbsej

  • MD5

    b419eae9ebbe0a00fde69f6bd0754d9f

  • SHA1

    928faa489c3fd9057dec949f4f15645eda27c575

  • SHA256

    0709ab8fe8219be3c9d28dfa854db90eb1d9a73bff98da2f4b62273f4f68bfee

  • SHA512

    004debff8ffd4e9d92ab2e53069153fb8eac9e689d75aec9cde84069147eb364cb34c70f79f00b8f7077ba11c0a47eff087a701f6b8d86662ad707f52f211765

Malware Config

Targets

    • Target

      0709ab8fe8219be3c9d28dfa854db90eb1d9a73bff98da2f4b62273f4f68bfee

    • Size

      479KB

    • MD5

      b419eae9ebbe0a00fde69f6bd0754d9f

    • SHA1

      928faa489c3fd9057dec949f4f15645eda27c575

    • SHA256

      0709ab8fe8219be3c9d28dfa854db90eb1d9a73bff98da2f4b62273f4f68bfee

    • SHA512

      004debff8ffd4e9d92ab2e53069153fb8eac9e689d75aec9cde84069147eb364cb34c70f79f00b8f7077ba11c0a47eff087a701f6b8d86662ad707f52f211765

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks