General

  • Target

    Order-97582_jpg.exe

  • Size

    796KB

  • Sample

    210113-fa4h47blls

  • MD5

    577a98dba5058ee319ea62cac727046e

  • SHA1

    36e84f64bff87a67043afa8ba8c23caecd8cd6de

  • SHA256

    df09a74d589a4bcb721422249bd9caeef3a44acd6bbf25aebc34629f1d9ecf61

  • SHA512

    e414a8b5c662b129705d4f49553b1f4501fb9a9954e0bbf6b584495af49d35de46c871562e6b593714cd9c71e25e3c732ff925229bd69c5d08446f0ceedad605

Malware Config

Targets

    • Target

      Order-97582_jpg.exe

    • Size

      796KB

    • MD5

      577a98dba5058ee319ea62cac727046e

    • SHA1

      36e84f64bff87a67043afa8ba8c23caecd8cd6de

    • SHA256

      df09a74d589a4bcb721422249bd9caeef3a44acd6bbf25aebc34629f1d9ecf61

    • SHA512

      e414a8b5c662b129705d4f49553b1f4501fb9a9954e0bbf6b584495af49d35de46c871562e6b593714cd9c71e25e3c732ff925229bd69c5d08446f0ceedad605

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Enterprise v6

Tasks