Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad96782e7d981c81c591e3be43bd54f77b51ec21512ea07c06f826baaa5af814

  • Size

    428KB

  • Sample

    210908-kd7easeah8

  • MD5

    af8f3813527ed13824f23e371f90c336

  • SHA1

    69b20f8d83a119292acdfcaf4f4ce03d5b34e23a

  • SHA256

    ad96782e7d981c81c591e3be43bd54f77b51ec21512ea07c06f826baaa5af814

  • SHA512

    534ebf2089894557372da331411370e7e55f7a4c9b40a5fe27367d2b4c52d86d3a1462c2c7ced4738917ffe607f709ff4590e871afb24a4fda561ccaf6caa542

Score
10/10
raccoon93d3ccba4a3cbd5e268873fc1760b2335272e198spywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

93d3ccba4a3cbd5e268873fc1760b2335272e198

Attributes
  • url4cnc

    https://telete.in/opa4kiprivatem

rc4.plain
rc4.plain

Targets

    • Target

      ad96782e7d981c81c591e3be43bd54f77b51ec21512ea07c06f826baaa5af814

    • Size

      428KB

    • MD5

      af8f3813527ed13824f23e371f90c336

    • SHA1

      69b20f8d83a119292acdfcaf4f4ce03d5b34e23a

    • SHA256

      ad96782e7d981c81c591e3be43bd54f77b51ec21512ea07c06f826baaa5af814

    • SHA512

      534ebf2089894557372da331411370e7e55f7a4c9b40a5fe27367d2b4c52d86d3a1462c2c7ced4738917ffe607f709ff4590e871afb24a4fda561ccaf6caa542

    Score
    10/10
    raccoon93d3ccba4a3cbd5e268873fc1760b2335272e198spywarestealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks