General

  • Target

    5c3b4daa345d656f8cb59287b5e638b0.exe

  • Size

    518KB

  • Sample

    210324-hxcvsm8jjx

  • MD5

    5c3b4daa345d656f8cb59287b5e638b0

  • SHA1

    42602009f2d394133db05103aa4bf886d9de286f

  • SHA256

    4f17f472b466e5e20dcece3207b53ffd5767ffa6f7d540cac3bbf4d8bd21f392

  • SHA512

    9b64d6d09e25dc0c69add7376128d7c624069c28f1d90ba7aef107d3023e0f0428508cb54897d46e5428a727cde85b883fe66974612fbe031fabdeb635092f1a

Malware Config

Extracted

Family

raccoon

Botnet

2ce901d964b370c5ccda7e4d68354ba040db8218

Attributes
  • url4cnc

    https://telete.in/tomarsjsmith3

rc4.plain
rc4.plain

Targets

    • Target

      5c3b4daa345d656f8cb59287b5e638b0.exe

    • Size

      518KB

    • MD5

      5c3b4daa345d656f8cb59287b5e638b0

    • SHA1

      42602009f2d394133db05103aa4bf886d9de286f

    • SHA256

      4f17f472b466e5e20dcece3207b53ffd5767ffa6f7d540cac3bbf4d8bd21f392

    • SHA512

      9b64d6d09e25dc0c69add7376128d7c624069c28f1d90ba7aef107d3023e0f0428508cb54897d46e5428a727cde85b883fe66974612fbe031fabdeb635092f1a

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks