General

  • Target

    4f2241ba18cc8fd46dc9dc7481212a5975ad9166f66e2542fc51f4fc4b49a94a

  • Size

    576KB

  • Sample

    201113-7ss7yqb6gj

  • MD5

    7fce8295768543aaf0e7f79c3bd8d3df

  • SHA1

    f72e5824b969a685fc61a17523086dc487064030

  • SHA256

    4f2241ba18cc8fd46dc9dc7481212a5975ad9166f66e2542fc51f4fc4b49a94a

  • SHA512

    1650d1719265386ad3b1a720a4ffbb9eead996b00081d37571c624508799006a10c23c98e8c38ce751cd2a6177cc0d4ade2d794c8ead5b82739cfbc25e5f9782

Malware Config

Targets

    • Target

      4f2241ba18cc8fd46dc9dc7481212a5975ad9166f66e2542fc51f4fc4b49a94a

    • Size

      576KB

    • MD5

      7fce8295768543aaf0e7f79c3bd8d3df

    • SHA1

      f72e5824b969a685fc61a17523086dc487064030

    • SHA256

      4f2241ba18cc8fd46dc9dc7481212a5975ad9166f66e2542fc51f4fc4b49a94a

    • SHA512

      1650d1719265386ad3b1a720a4ffbb9eead996b00081d37571c624508799006a10c23c98e8c38ce751cd2a6177cc0d4ade2d794c8ead5b82739cfbc25e5f9782

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks