General

  • Target

    02c4f8bcd51f2c9b0da09ba6c8a3500c.exe

  • Size

    461KB

  • Sample

    210129-z367ddqhdn

  • MD5

    02c4f8bcd51f2c9b0da09ba6c8a3500c

  • SHA1

    717ed9be2c6f564178e70d8db0a7fc80694e1ca0

  • SHA256

    474f04d64d2154c12453d8ad47e755926887b851ad5a770932f6de8e9c70f009

  • SHA512

    9faef2b489c0e37e77f9c55b5677cf5cec3897ab680aeca3c4a3356212edeb92524ea0e63c73813ffc9a28635319226e725b089296af2e72fb3300ce424dcdb2

Malware Config

Targets

    • Target

      02c4f8bcd51f2c9b0da09ba6c8a3500c.exe

    • Size

      461KB

    • MD5

      02c4f8bcd51f2c9b0da09ba6c8a3500c

    • SHA1

      717ed9be2c6f564178e70d8db0a7fc80694e1ca0

    • SHA256

      474f04d64d2154c12453d8ad47e755926887b851ad5a770932f6de8e9c70f009

    • SHA512

      9faef2b489c0e37e77f9c55b5677cf5cec3897ab680aeca3c4a3356212edeb92524ea0e63c73813ffc9a28635319226e725b089296af2e72fb3300ce424dcdb2

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • JavaScript code in executable

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks