General

  • Target

    389abb321d08fe6cefc1ac0a494024d6.exe

  • Size

    440KB

  • Sample

    210129-w2g9k3snna

  • MD5

    389abb321d08fe6cefc1ac0a494024d6

  • SHA1

    b5b35ec50abd41933ab66fdd7d36c92b08b4df1b

  • SHA256

    86df663a0166596d6d7481f5f19e4913abbc3bb0f49dbf116281bdcf9baa5d77

  • SHA512

    96f1f22059fc9b7c0bfeb75b72be2086dfa31eeea8f5b9bfe1a23f61de4b944a187cf0123aa936aa65428e4e94b2cd1ad5aced0c61267fbd31233d98f28f231f

Malware Config

Targets

    • Target

      389abb321d08fe6cefc1ac0a494024d6.exe

    • Size

      440KB

    • MD5

      389abb321d08fe6cefc1ac0a494024d6

    • SHA1

      b5b35ec50abd41933ab66fdd7d36c92b08b4df1b

    • SHA256

      86df663a0166596d6d7481f5f19e4913abbc3bb0f49dbf116281bdcf9baa5d77

    • SHA512

      96f1f22059fc9b7c0bfeb75b72be2086dfa31eeea8f5b9bfe1a23f61de4b944a187cf0123aa936aa65428e4e94b2cd1ad5aced0c61267fbd31233d98f28f231f

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks