General
-
Target
usfive_20210808-181522
-
Size
511KB
-
Sample
210808-84yecf8sb2
-
MD5
c516b8434e20fba2c5ce93414bdd06a6
-
SHA1
1fd7e3712d1d2bd96997d18280fbf0afe4569097
-
SHA256
7c5200cb3685f3ba1d2a3c4bbf7b92db3a004b2443843f1b6bac425d72a5733c
-
SHA512
7f13118474dd26dd5eba89cadf8e169ac15f5a488154dffbcaadb9daa29554a17ae895d5a2bc89499a35887f27beb82657e5b12fad066b1c9acade362de08e5c
Static task
static1
Behavioral task
behavioral1
Sample
usfive_20210808-181522.exe
Resource
win7v20210410
Malware Config
Extracted
raccoon
c58b0b3f1f90ad7552aaf8e84180b7580f397001
-
url4cnc
https://telete.in/h_electricryptors2
Targets
-
-
Target
usfive_20210808-181522
-
Size
511KB
-
MD5
c516b8434e20fba2c5ce93414bdd06a6
-
SHA1
1fd7e3712d1d2bd96997d18280fbf0afe4569097
-
SHA256
7c5200cb3685f3ba1d2a3c4bbf7b92db3a004b2443843f1b6bac425d72a5733c
-
SHA512
7f13118474dd26dd5eba89cadf8e169ac15f5a488154dffbcaadb9daa29554a17ae895d5a2bc89499a35887f27beb82657e5b12fad066b1c9acade362de08e5c
-
Raccoon Stealer Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
DarkVNC Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-