raccoon | df54323826b980b05e5bbfe7c12a6594ba14821797d90688f3428b142e12a653 | Triage

Sharing

General

Target

df54323826b980b05e5bbfe7c12a6594ba14821797d90688f3428b142e12a653
Size

512KB
Sample

211021-xhamcaafd5
MD5

12e085599119bedc6c218ad1c339bc60
SHA1

9842a81f958514a7a0fff89a4f0ae332080a2d43
SHA256

df54323826b980b05e5bbfe7c12a6594ba14821797d90688f3428b142e12a653
SHA512

8ef9870e35b7442403b6b91879826782d9de582033e4142570a45c51cd5f112e3f70a20537b6fe6f4a9baf36ae71d9ca2667a911705c314ecd2fccac1ecfd6e6

Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  df54323826b980b05e5bbfe7c12a6594ba14821797d90688f3428b142e12a653
- Size
  
  512KB
- MD5
  
  12e085599119bedc6c218ad1c339bc60
- SHA1
  
  9842a81f958514a7a0fff89a4f0ae332080a2d43
- SHA256
  
  df54323826b980b05e5bbfe7c12a6594ba14821797d90688f3428b142e12a653
- SHA512
  
  8ef9870e35b7442403b6b91879826782d9de582033e4142570a45c51cd5f112e3f70a20537b6fe6f4a9baf36ae71d9ca2667a911705c314ecd2fccac1ecfd6e6
Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon7ebf9b416b72a203df65383eec899dc689d2c3d7stealer