General
-
Target
4a4ca3c2a590908f65aaad5f0099052e7b12fde25539a10bec517f7ba3a143ec
-
Size
419KB
-
Sample
210926-w26nfsfbcn
-
MD5
c0190f427c134c069f949b4eb0dac8d8
-
SHA1
0cebafbf985b2067a4cdc79755f9699ffe5e8f39
-
SHA256
4a4ca3c2a590908f65aaad5f0099052e7b12fde25539a10bec517f7ba3a143ec
-
SHA512
9699055712c51539838e6559a5acc47bbb919801f863456ca9743b9c23cdefe6269f28de732106e06bc2e2d07eb047090d8a065b664a8c452a236d7589c99f35
Malware Config
Extracted
raccoon
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
-
url4cnc
https://t.me/agrybirdsgamerept
Targets
-
-
Target
4a4ca3c2a590908f65aaad5f0099052e7b12fde25539a10bec517f7ba3a143ec
-
Size
419KB
-
MD5
c0190f427c134c069f949b4eb0dac8d8
-
SHA1
0cebafbf985b2067a4cdc79755f9699ffe5e8f39
-
SHA256
4a4ca3c2a590908f65aaad5f0099052e7b12fde25539a10bec517f7ba3a143ec
-
SHA512
9699055712c51539838e6559a5acc47bbb919801f863456ca9743b9c23cdefe6269f28de732106e06bc2e2d07eb047090d8a065b664a8c452a236d7589c99f35
Score10/10-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-