General

  • Target

    34d196e9b5a71f5846ccae9d0c4bbcc2.exe

  • Size

    472KB

  • Sample

    210301-agef67ma5s

  • MD5

    34d196e9b5a71f5846ccae9d0c4bbcc2

  • SHA1

    b47a0525e3a6f39d7b4b8c1736223e31a276f029

  • SHA256

    a07bff50fc241defe458c76a1a47eba870d30bdcd1d2a1594de71f46a32b2f28

  • SHA512

    6ab6e991e30fb0e3a6e98c644746c1992ccfb3a16e39f5841ad80ac8e4f4ae338e68ad7cbd5511c346a5233699a216f4492cb1c2b9f1a91b338019dad9da861d

Malware Config

Extracted

Family

raccoon

Botnet

a3a85b69314053c3bb015532d1a960a3d08baeb8

Attributes
  • url4cnc

    https://telete.in/baudemars

rc4.plain
rc4.plain

Targets

    • Target

      34d196e9b5a71f5846ccae9d0c4bbcc2.exe

    • Size

      472KB

    • MD5

      34d196e9b5a71f5846ccae9d0c4bbcc2

    • SHA1

      b47a0525e3a6f39d7b4b8c1736223e31a276f029

    • SHA256

      a07bff50fc241defe458c76a1a47eba870d30bdcd1d2a1594de71f46a32b2f28

    • SHA512

      6ab6e991e30fb0e3a6e98c644746c1992ccfb3a16e39f5841ad80ac8e4f4ae338e68ad7cbd5511c346a5233699a216f4492cb1c2b9f1a91b338019dad9da861d

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks