Overview

overview

10

Static

static

41FA35AD45...B8.exe

windows7_x64

10

41FA35AD45...B8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41FA35AD45D4442404F2F970EE3578B8.exe

  • Size

    6.6MB

  • Sample

    210811-7svc57m2n6

  • MD5

    41fa35ad45d4442404f2f970ee3578b8

  • SHA1

    61577d5ff6b0c870d51fbb3463ce920b2cd191a7

  • SHA256

    56f1c287ea437e4642a04cfb0f44f2dcc74a0eeb3204aba76fd0c64f31b0dffd

  • SHA512

    778972963c3aa9119877e7ab885b14eb2eadbe9bf3bba28365fee48e4bb4ba351680a980cb2c34ceafaa2258ccd86c28ee1532667cf3aec138c647eab8819096

Score
10/10
raccoonbb8d3701ca5d8e031967c87b862623b34997b3d1stealer

Malware Config

Extracted

Family

raccoon

Botnet

bb8d3701ca5d8e031967c87b862623b34997b3d1

Attributes
  • url4cnc

    https://telete.in/jdiamond13

rc4.plain
rc4.plain

Targets

    • Target

      41FA35AD45D4442404F2F970EE3578B8.exe

    • Size

      6.6MB

    • MD5

      41fa35ad45d4442404f2f970ee3578b8

    • SHA1

      61577d5ff6b0c870d51fbb3463ce920b2cd191a7

    • SHA256

      56f1c287ea437e4642a04cfb0f44f2dcc74a0eeb3204aba76fd0c64f31b0dffd

    • SHA512

      778972963c3aa9119877e7ab885b14eb2eadbe9bf3bba28365fee48e4bb4ba351680a980cb2c34ceafaa2258ccd86c28ee1532667cf3aec138c647eab8819096

    Score
    10/10
    raccoonbb8d3701ca5d8e031967c87b862623b34997b3d1stealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Raccoon Stealer Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks