raccoon | 886560f762cfbcd2d6fec6d3406168b3c3951df8d286a082e0b9f2116270a37b | Triage

Sharing

General

Target

886560f762cfbcd2d6fec6d3406168b3c3951df8d286a082e0b9f2116270a37b
Size

512KB
Sample

211021-ema5kaafhl
MD5

5b03cd7a3dcc218d6bc8ca16ff89f7cb
SHA1

429bda044e896073bf8e40fdfad190283277d0cf
SHA256

886560f762cfbcd2d6fec6d3406168b3c3951df8d286a082e0b9f2116270a37b
SHA512

0c114b171f029b7aee6143cf7cb365b3933c7368a694d178d73a6678b223121aa782e85f795e0f14653ba397eb3e56abd77e3cd4985fcdc7691183f04d43deb7

Score

10^/10

raccoon 887a0ffaca448362277f2227182491216b734133 stealer

Malware Config

Extracted

Family

raccoon

Botnet

887a0ffaca448362277f2227182491216b734133

Attributes

url4cnc
http://telegka.top/jdiamond13
http://telegin.top/jdiamond13
https://t.me/jdiamond13

rc4.plain

rc4.plain

Targets

- Target
  
  886560f762cfbcd2d6fec6d3406168b3c3951df8d286a082e0b9f2116270a37b
- Size
  
  512KB
- MD5
  
  5b03cd7a3dcc218d6bc8ca16ff89f7cb
- SHA1
  
  429bda044e896073bf8e40fdfad190283277d0cf
- SHA256
  
  886560f762cfbcd2d6fec6d3406168b3c3951df8d286a082e0b9f2116270a37b
- SHA512
  
  0c114b171f029b7aee6143cf7cb365b3933c7368a694d178d73a6678b223121aa782e85f795e0f14653ba397eb3e56abd77e3cd4985fcdc7691183f04d43deb7
Score

10^/10

raccoon 887a0ffaca448362277f2227182491216b734133 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon887a0ffaca448362277f2227182491216b734133stealer