General

  • Target

    a03b02fddec9a527e5bd2ec6e17fbb3e

  • Size

    506KB

  • Sample

    210721-bstcrpm3wj

  • MD5

    a03b02fddec9a527e5bd2ec6e17fbb3e

  • SHA1

    da6b0023136519a5b52ddab22227a31e84cdd927

  • SHA256

    0c66ab7992f278f1bbcc3256c2dc934b9e87247c2dfbe234a8d4c4800aef8e0f

  • SHA512

    61e5db4ae0b168f3d4b93326052f82f4d46f647d6de519530ac6ae9cf5134d0c2ce525d0304fdfe07ea0888c5fdf2eb8e7f08dfe759d77449cefb357273e72a4

Malware Config

Targets

    • Target

      a03b02fddec9a527e5bd2ec6e17fbb3e

    • Size

      506KB

    • MD5

      a03b02fddec9a527e5bd2ec6e17fbb3e

    • SHA1

      da6b0023136519a5b52ddab22227a31e84cdd927

    • SHA256

      0c66ab7992f278f1bbcc3256c2dc934b9e87247c2dfbe234a8d4c4800aef8e0f

    • SHA512

      61e5db4ae0b168f3d4b93326052f82f4d46f647d6de519530ac6ae9cf5134d0c2ce525d0304fdfe07ea0888c5fdf2eb8e7f08dfe759d77449cefb357273e72a4

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Tasks