General

  • Target

    D6B2E107AC7BA9CB55FCEB901651519B.exe

  • Size

    518KB

  • Sample

    210805-xkfal3l6h2

  • MD5

    d6b2e107ac7ba9cb55fceb901651519b

  • SHA1

    a225e6ebcdc0a7b69e9fb588d1e88b3d576d8392

  • SHA256

    91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26

  • SHA512

    d417d7a8e0ee1565f5a70503e7fde1279da3bf4df7bc3dcb1c7d51b0790216a9e18e58b061fdae652f04feccfa57e5b8433b82a5c2fb34c7022394a0055feb3b

Malware Config

Extracted

Family

raccoon

Botnet

92be0387873e54dd629b9bfa972c3a9a88e6726c

Attributes
  • url4cnc

    https://t.me/gishsunsetman

rc4.plain
rc4.plain

Targets

    • Target

      D6B2E107AC7BA9CB55FCEB901651519B.exe

    • Size

      518KB

    • MD5

      d6b2e107ac7ba9cb55fceb901651519b

    • SHA1

      a225e6ebcdc0a7b69e9fb588d1e88b3d576d8392

    • SHA256

      91eb4aa588c6607ad27fb9b43d61166230a225d8a4aa517d685af28ab4382a26

    • SHA512

      d417d7a8e0ee1565f5a70503e7fde1279da3bf4df7bc3dcb1c7d51b0790216a9e18e58b061fdae652f04feccfa57e5b8433b82a5c2fb34c7022394a0055feb3b

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Raccoon Stealer Payload

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks