General

  • Target

    SecuriteInfo.com.Trojan.Win32.Save.a.3056.28487

  • Size

    509KB

  • Sample

    210721-324fdkc8w6

  • MD5

    0fb3a2f1fc33bfa7679bc431c14bda58

  • SHA1

    9acfa3fdef04e3fa0020a178a792c53e67d5f61f

  • SHA256

    cb00c6d4692dba24ced86cb2c28685c5fba1a05492b1a6454c1cf92d6b2f99eb

  • SHA512

    9c9299df760b98aa75909f9ee7d2d0c7a1a05dbc6d2d04333e8ee038ca96e9d31d27edd972cb3612670f8d8f3c1fe4dd5ddd047545a8df20b5cf19673d2498cc

Malware Config

Targets

    • Target

      SecuriteInfo.com.Trojan.Win32.Save.a.3056.28487

    • Size

      509KB

    • MD5

      0fb3a2f1fc33bfa7679bc431c14bda58

    • SHA1

      9acfa3fdef04e3fa0020a178a792c53e67d5f61f

    • SHA256

      cb00c6d4692dba24ced86cb2c28685c5fba1a05492b1a6454c1cf92d6b2f99eb

    • SHA512

      9c9299df760b98aa75909f9ee7d2d0c7a1a05dbc6d2d04333e8ee038ca96e9d31d27edd972cb3612670f8d8f3c1fe4dd5ddd047545a8df20b5cf19673d2498cc

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks