raccoon | 0adb712f11afe2394b49846e02fff3f995e924fe8dc8452e651406fe009781d0 | Triage

Sharing

General

Target

0adb712f11afe2394b49846e02fff3f995e924fe8dc8452e651406fe009781d0
Size

512KB
Sample

211021-txvdhsaed7
MD5

4890d95cbd60bac6498c63e523ce7184
SHA1

7f0e481bf4369ec948e8d07f25dbe74aef066247
SHA256

0adb712f11afe2394b49846e02fff3f995e924fe8dc8452e651406fe009781d0
SHA512

530c9f42f0b4634df07891308eb667f06a225e21f8210cffbc54b504473011211735d5edd5791facb02dbae2f57222457ad9548655cedc06c037561c18701540

Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  0adb712f11afe2394b49846e02fff3f995e924fe8dc8452e651406fe009781d0
- Size
  
  512KB
- MD5
  
  4890d95cbd60bac6498c63e523ce7184
- SHA1
  
  7f0e481bf4369ec948e8d07f25dbe74aef066247
- SHA256
  
  0adb712f11afe2394b49846e02fff3f995e924fe8dc8452e651406fe009781d0
- SHA512
  
  530c9f42f0b4634df07891308eb667f06a225e21f8210cffbc54b504473011211735d5edd5791facb02dbae2f57222457ad9548655cedc06c037561c18701540
Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon7ebf9b416b72a203df65383eec899dc689d2c3d7stealer