General

  • Target

    af37877133e6e656c670126e562f53e50be8867239e7e.exe

  • Size

    545KB

  • Sample

    211002-emmtcsdfb8

  • MD5

    3e25cafa3b47c32f989078772a9e7a55

  • SHA1

    c2c9d899b5880d1203caf46ca9fb79f03adc3fdc

  • SHA256

    af37877133e6e656c670126e562f53e50be8867239e7e0b2beb88072ec6ea76e

  • SHA512

    4eb505e731d0cf7c36889f8f29d053a660e3329a5a3e10e0b558306be89316cf893fd006b19b0975310b8f933af60ad1ff0e1429eb5940979b4c70f5a7ecdc7f

Malware Config

Extracted

Family

raccoon

Version

1.8.2

Botnet

1ec902112b48b86eaf116e67218e531d05852427

Attributes
  • url4cnc

    http://teletop.top/papatikmikr0

    http://teleta.top/papatikmikr0

    https://t.me/papatikmikr0

rc4.plain
rc4.plain

Targets

    • Target

      af37877133e6e656c670126e562f53e50be8867239e7e.exe

    • Size

      545KB

    • MD5

      3e25cafa3b47c32f989078772a9e7a55

    • SHA1

      c2c9d899b5880d1203caf46ca9fb79f03adc3fdc

    • SHA256

      af37877133e6e656c670126e562f53e50be8867239e7e0b2beb88072ec6ea76e

    • SHA512

      4eb505e731d0cf7c36889f8f29d053a660e3329a5a3e10e0b558306be89316cf893fd006b19b0975310b8f933af60ad1ff0e1429eb5940979b4c70f5a7ecdc7f

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Downloads MZ/PE file

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

2
T1114

Tasks