General

  • Target

    758ff871a26aed3ff253d48d82fde6a1.exe

  • Size

    440KB

  • Sample

    210129-8y3h568tee

  • MD5

    758ff871a26aed3ff253d48d82fde6a1

  • SHA1

    26815d54ac9f7f8b09fc4ed3c3f0d9e8590869bf

  • SHA256

    ac2939d998d1b711db4d490718c97705f00a8ffa6f23f14228959052a3381610

  • SHA512

    ecdc3ae624889b90559fa6eb12b2536f1ab52f1ce226fed6ef555ec314b93f75e0170225a75aeff2743717685d8df9e315fb0610c5ae7b614e3c7448676848b2

Malware Config

Targets

    • Target

      758ff871a26aed3ff253d48d82fde6a1.exe

    • Size

      440KB

    • MD5

      758ff871a26aed3ff253d48d82fde6a1

    • SHA1

      26815d54ac9f7f8b09fc4ed3c3f0d9e8590869bf

    • SHA256

      ac2939d998d1b711db4d490718c97705f00a8ffa6f23f14228959052a3381610

    • SHA512

      ecdc3ae624889b90559fa6eb12b2536f1ab52f1ce226fed6ef555ec314b93f75e0170225a75aeff2743717685d8df9e315fb0610c5ae7b614e3c7448676848b2

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks