General
-
Target
61debeeaa664d8da1d895749ca13f932.exe
-
Size
504KB
-
Sample
210811-f3rrpb77pj
-
MD5
61debeeaa664d8da1d895749ca13f932
-
SHA1
aa0ee173649f0d0e16fdf42c5ce54049dab4acd9
-
SHA256
29924af043739881674c7d7ac9d2d08a5021e41484a49f28ee43d253cb9e3be7
-
SHA512
6858e239d997fbcb9ca8a4585e44d895d914f970f27852a0eaef2f77ed3505510dcb61d9aa07a6c7e50636144b4efaba099523db00063b09491b13a8343432b7
Static task
static1
Behavioral task
behavioral1
Sample
61debeeaa664d8da1d895749ca13f932.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
61debeeaa664d8da1d895749ca13f932.exe
Resource
win10v20210410
Malware Config
Extracted
raccoon
83fbe81dd43f775dd8af3cd619f88f428fbd9a96
-
url4cnc
https://telete.in/opa4kiprivatem
Targets
-
-
Target
61debeeaa664d8da1d895749ca13f932.exe
-
Size
504KB
-
MD5
61debeeaa664d8da1d895749ca13f932
-
SHA1
aa0ee173649f0d0e16fdf42c5ce54049dab4acd9
-
SHA256
29924af043739881674c7d7ac9d2d08a5021e41484a49f28ee43d253cb9e3be7
-
SHA512
6858e239d997fbcb9ca8a4585e44d895d914f970f27852a0eaef2f77ed3505510dcb61d9aa07a6c7e50636144b4efaba099523db00063b09491b13a8343432b7
-
Raccoon Stealer Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-