General
-
Target
5b8d654666c039518933e112214c380630e3d588f3143f0eba1a69a1e837cca0
-
Size
420KB
-
Sample
210926-3dp45afdal
-
MD5
663720a684eff50de9e6956ed87c6ae7
-
SHA1
6a67c3ae68f8a1d77ead8c3d3ce2edd65b79e06d
-
SHA256
5b8d654666c039518933e112214c380630e3d588f3143f0eba1a69a1e837cca0
-
SHA512
c5aa0fa7a05565be9f40ca5c8a175c177a1d1d9d657a3404b27437165b9fe9e20bfe85bbe131b2cdb0541f2f5f849e160212bcdd348db1c7a0327fe65cc13c10
Malware Config
Extracted
raccoon
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
-
url4cnc
https://t.me/agrybirdsgamerept
Targets
-
-
Target
5b8d654666c039518933e112214c380630e3d588f3143f0eba1a69a1e837cca0
-
Size
420KB
-
MD5
663720a684eff50de9e6956ed87c6ae7
-
SHA1
6a67c3ae68f8a1d77ead8c3d3ce2edd65b79e06d
-
SHA256
5b8d654666c039518933e112214c380630e3d588f3143f0eba1a69a1e837cca0
-
SHA512
c5aa0fa7a05565be9f40ca5c8a175c177a1d1d9d657a3404b27437165b9fe9e20bfe85bbe131b2cdb0541f2f5f849e160212bcdd348db1c7a0327fe65cc13c10
Score10/10-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-