General

  • Target

    0546cc2b40978832d956bb5e4267652609bb8873a3675928bd50ba3753199aea

  • Size

    403KB

  • Sample

    201113-5v8q7cgjdn

  • MD5

    7e7b895d28dc2b9b16de479049b41f10

  • SHA1

    92900f85e6d159c1e61f0942698d1a1489bb5fce

  • SHA256

    0546cc2b40978832d956bb5e4267652609bb8873a3675928bd50ba3753199aea

  • SHA512

    fbd870e0d427c024715e44da0002fd7ba0749a2a8a42b4c7720db721706c30aaa4bff3ca714b3a3eefd0f438d2043573214236478f6351c3ed3826d34ee4fc54

Malware Config

Targets

    • Target

      0546cc2b40978832d956bb5e4267652609bb8873a3675928bd50ba3753199aea

    • Size

      403KB

    • MD5

      7e7b895d28dc2b9b16de479049b41f10

    • SHA1

      92900f85e6d159c1e61f0942698d1a1489bb5fce

    • SHA256

      0546cc2b40978832d956bb5e4267652609bb8873a3675928bd50ba3753199aea

    • SHA512

      fbd870e0d427c024715e44da0002fd7ba0749a2a8a42b4c7720db721706c30aaa4bff3ca714b3a3eefd0f438d2043573214236478f6351c3ed3826d34ee4fc54

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks