General

  • Target

    186174817871c21ba0dd93d05b12110f.exe

  • Size

    440KB

  • Sample

    210129-7ffqj6tt9x

  • MD5

    186174817871c21ba0dd93d05b12110f

  • SHA1

    aa2fb0e6c959446aaa25ca3672651c53d09aa773

  • SHA256

    13e13c9a09af45bd0705d94ff3d7fc95d5d5911311d25a034e9136b80dcf834d

  • SHA512

    d1e58e05392fb03b5010ba63e779e97fabe88f0249941c13f02fa0ee19f901662f5010a7e6ed0d5ad821af7b7dcb70462aec56a73154f2d6644d1bbcc295389e

Malware Config

Targets

    • Target

      186174817871c21ba0dd93d05b12110f.exe

    • Size

      440KB

    • MD5

      186174817871c21ba0dd93d05b12110f

    • SHA1

      aa2fb0e6c959446aaa25ca3672651c53d09aa773

    • SHA256

      13e13c9a09af45bd0705d94ff3d7fc95d5d5911311d25a034e9136b80dcf834d

    • SHA512

      d1e58e05392fb03b5010ba63e779e97fabe88f0249941c13f02fa0ee19f901662f5010a7e6ed0d5ad821af7b7dcb70462aec56a73154f2d6644d1bbcc295389e

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks