General

  • Target

    e5cacb2e5ef54c285b98bddfef83e2c1167cbc48cfc0d5ce67d6c3ff2b7dd8fa

  • Size

    576KB

  • Sample

    201109-w599rfqm26

  • MD5

    657bb7e251bd1debd4c5918f168d0c78

  • SHA1

    ae3d12c6af7f4c9ea590d18e474389a3392b7baa

  • SHA256

    e5cacb2e5ef54c285b98bddfef83e2c1167cbc48cfc0d5ce67d6c3ff2b7dd8fa

  • SHA512

    116bd772232e46a88d4274167bfd92c4db33edbb2ba9722f12a74fe91806bca4c617db14d94524239e25a44aeef122578bcf463b417c73a25d0ee5f29efa2436

Malware Config

Targets

    • Target

      e5cacb2e5ef54c285b98bddfef83e2c1167cbc48cfc0d5ce67d6c3ff2b7dd8fa

    • Size

      576KB

    • MD5

      657bb7e251bd1debd4c5918f168d0c78

    • SHA1

      ae3d12c6af7f4c9ea590d18e474389a3392b7baa

    • SHA256

      e5cacb2e5ef54c285b98bddfef83e2c1167cbc48cfc0d5ce67d6c3ff2b7dd8fa

    • SHA512

      116bd772232e46a88d4274167bfd92c4db33edbb2ba9722f12a74fe91806bca4c617db14d94524239e25a44aeef122578bcf463b417c73a25d0ee5f29efa2436

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks