Overview

overview

10

Static

static

6b6dbe5994...f8.exe

windows7_x64

10

6b6dbe5994...f8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6b6dbe5994035fb38d67e8016a2880f8.exe

  • Size

    522KB

  • Sample

    210418-9npt3fj86n

  • MD5

    6b6dbe5994035fb38d67e8016a2880f8

  • SHA1

    bf6a1f6104467797c3a1950c696bfbc675466e0e

  • SHA256

    de9f40e715e0fb08f29c98608df23b62bd3a15195e99d9ca9bbeb42ca2c3126d

  • SHA512

    ca232bb2ca8dacaebac8079179628a274fd973a5389eed0e6ffd22b8f3f43c3bad3ae13ead393334ba9579645ffb1da9ea4d714f4d80301299c396ed20315f68

Score
10/10
raccoonfe080c9bfcbe54ed632d9562ae158e815dbdc717stealer

Malware Config

Extracted

Family

raccoon

Botnet

fe080c9bfcbe54ed632d9562ae158e815dbdc717

Attributes
  • url4cnc

    https://telete.in/jdiamond13

rc4.plain
rc4.plain

Targets

    • Target

      6b6dbe5994035fb38d67e8016a2880f8.exe

    • Size

      522KB

    • MD5

      6b6dbe5994035fb38d67e8016a2880f8

    • SHA1

      bf6a1f6104467797c3a1950c696bfbc675466e0e

    • SHA256

      de9f40e715e0fb08f29c98608df23b62bd3a15195e99d9ca9bbeb42ca2c3126d

    • SHA512

      ca232bb2ca8dacaebac8079179628a274fd973a5389eed0e6ffd22b8f3f43c3bad3ae13ead393334ba9579645ffb1da9ea4d714f4d80301299c396ed20315f68

    Score
    10/10
    raccoonfe080c9bfcbe54ed632d9562ae158e815dbdc717stealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks