General

  • Target

    93350c9069a7da467e2c8344b3397c39.exe

  • Size

    492KB

  • Sample

    210304-q7b89k87cj

  • MD5

    93350c9069a7da467e2c8344b3397c39

  • SHA1

    09c127d82da25ba2ac5cf302f4489167d7c88447

  • SHA256

    ab8c30cc33d7f7961b9e6830efd243d6f335c7d1c704ab7a661de3785cf45d5c

  • SHA512

    09b2edb6935ce746e8a8dae1b46955f199ed82946b795c8b2580bb97866707544f19e8c993e6c4c444dfd5bc26f2080d5e1296f7f412890ee7dbbc6265867c48

Malware Config

Extracted

Family

raccoon

Botnet

563129eb2a69de0d6dd4671019520d08f6eb4830

Attributes
  • url4cnc

    https://telete.in/bItalianoespanol

rc4.plain
rc4.plain

Targets

    • Target

      93350c9069a7da467e2c8344b3397c39.exe

    • Size

      492KB

    • MD5

      93350c9069a7da467e2c8344b3397c39

    • SHA1

      09c127d82da25ba2ac5cf302f4489167d7c88447

    • SHA256

      ab8c30cc33d7f7961b9e6830efd243d6f335c7d1c704ab7a661de3785cf45d5c

    • SHA512

      09b2edb6935ce746e8a8dae1b46955f199ed82946b795c8b2580bb97866707544f19e8c993e6c4c444dfd5bc26f2080d5e1296f7f412890ee7dbbc6265867c48

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Tasks