General
-
Target
85fb42a57db662ade20dbc90dd2abccb
-
Size
462KB
-
Sample
210814-fzyfdb62qx
-
MD5
85fb42a57db662ade20dbc90dd2abccb
-
SHA1
eb1718103d030704bfb0959bb43f38ece27f94bd
-
SHA256
d260c05305ca6eda79e4aa38377a16df0bc5861ee1f79187c8838d93a06f2175
-
SHA512
12c43b3c25f7c594f38202ad46f655caeb98ea33aba4801cfcce84f98adcef406201b950e02b5562e330d86e5cf9e6dd02f0730df43b87f0c6b430ef9ba396c9
Static task
static1
Behavioral task
behavioral1
Sample
85fb42a57db662ade20dbc90dd2abccb.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
85fb42a57db662ade20dbc90dd2abccb.exe
Resource
win10v20210408
Malware Config
Extracted
raccoon
cd8dc1031358b1aec55cc6bc447df1018b068607
-
url4cnc
https://telete.in/jagressor_kz
Targets
-
-
Target
85fb42a57db662ade20dbc90dd2abccb
-
Size
462KB
-
MD5
85fb42a57db662ade20dbc90dd2abccb
-
SHA1
eb1718103d030704bfb0959bb43f38ece27f94bd
-
SHA256
d260c05305ca6eda79e4aa38377a16df0bc5861ee1f79187c8838d93a06f2175
-
SHA512
12c43b3c25f7c594f38202ad46f655caeb98ea33aba4801cfcce84f98adcef406201b950e02b5562e330d86e5cf9e6dd02f0730df43b87f0c6b430ef9ba396c9
-
Raccoon Stealer Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-