General

  • Target

    0ea2acb1973aa50850a4e7b4a37729d4

  • Size

    563KB

  • Sample

    201117-l4p3f7xf1s

  • MD5

    3473bc8d369b0b57f0cbce0637984a89

  • SHA1

    a64e73091929cb35575c39ecdc470f9e53e819e5

  • SHA256

    fc4b05b61482306c9dda17cf7af4e3730f952d7f4d8d97d58cb23d872f964717

  • SHA512

    9f4622e719b21da85b52ca7e2238a13bd0909f6d83d2b7514f397e8e8e350115693e14474f7303a3b90d9c87ea29aee22ad9437719ec81773e0a426b38d53f8b

Malware Config

Targets

    • Target

      0ea2acb1973aa50850a4e7b4a37729d4

    • Size

      563KB

    • MD5

      3473bc8d369b0b57f0cbce0637984a89

    • SHA1

      a64e73091929cb35575c39ecdc470f9e53e819e5

    • SHA256

      fc4b05b61482306c9dda17cf7af4e3730f952d7f4d8d97d58cb23d872f964717

    • SHA512

      9f4622e719b21da85b52ca7e2238a13bd0909f6d83d2b7514f397e8e8e350115693e14474f7303a3b90d9c87ea29aee22ad9437719ec81773e0a426b38d53f8b

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks