General

  • Target

    0b184fd1c1c4004732543ec8fcfb2dec.exe

  • Size

    514KB

  • Sample

    210129-mmjke78r12

  • MD5

    0b184fd1c1c4004732543ec8fcfb2dec

  • SHA1

    747f75f05e84514023166961cceb56c664ed0589

  • SHA256

    127bb75c78b17e56c5209da264f9a0fcfdc25ecb677fc4944d6f899ba17a59cc

  • SHA512

    bfce0f2de64147050e3719a6a550179475ade074c3263e93c25e896de2b99e7a5fccfe9053294dc1a6dd3973eac8015c7675d993c746a8012999d54324842a49

Malware Config

Targets

    • Target

      0b184fd1c1c4004732543ec8fcfb2dec.exe

    • Size

      514KB

    • MD5

      0b184fd1c1c4004732543ec8fcfb2dec

    • SHA1

      747f75f05e84514023166961cceb56c664ed0589

    • SHA256

      127bb75c78b17e56c5209da264f9a0fcfdc25ecb677fc4944d6f899ba17a59cc

    • SHA512

      bfce0f2de64147050e3719a6a550179475ade074c3263e93c25e896de2b99e7a5fccfe9053294dc1a6dd3973eac8015c7675d993c746a8012999d54324842a49

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks