raccoon

General

Target

5d834cb40d77d8287173c9e92876dc2c
Size

3.6MB
Sample

211002-c3mgesdehl
MD5

5d834cb40d77d8287173c9e92876dc2c
SHA1

2b6f0e77283e1b8d76f39e1f10d3b66ec87d9d93
SHA256

938e3a3002b3668c14418474d931bd3abaa44505928ac26430ed0898078275c7
SHA512

014226cf9e8913c2d08db8c1208843ed884f9ddbfe89c7598441bda289e0d79f662539378602850b75731dcf7844a39dd757bd29bde245f67c23c897d4e3d09b

Score

10^/10

raccoon � um@�y]��sn)r��b��jbd~7�4�e�9�{�discovery spyware stealer suricata

Malware Config

Extracted

Family

raccoon

Botnet

� um@�Y]��sN)R��B��Jbd~7�4�e�9�{�

Attributes

url4cnc
�cb{K^�WXP�۸��fB:O�ѡԾ"e.�p�tI�'�.��kAd(8��(�G�� a�@�R��jN�V��N*��

rc4.plain

Targets

- Target
  
  5d834cb40d77d8287173c9e92876dc2c
- Size
  
  3.6MB
- MD5
  
  5d834cb40d77d8287173c9e92876dc2c
- SHA1
  
  2b6f0e77283e1b8d76f39e1f10d3b66ec87d9d93
- SHA256
  
  938e3a3002b3668c14418474d931bd3abaa44505928ac26430ed0898078275c7
- SHA512
  
  014226cf9e8913c2d08db8c1208843ed884f9ddbfe89c7598441bda289e0d79f662539378602850b75731dcf7844a39dd757bd29bde245f67c23c897d4e3d09b
Score

10^/10

raccoon � um@�y]��sn)r��b��jbd~7�4�e�9�{�discovery spyware stealer suricata
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
  suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
  suricata
- suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
  suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
  suricata
- Downloads MZ/PE file
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

Downloads MZ/PE file

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2