raccoon | 9a8da0f07d1b4c6f775eb968b68eb6f48b5e00869232822e4f599859a4bc696e | Triage

Sharing

General

Target

9a8da0f07d1b4c6f775eb968b68eb6f48b5e00869232822e4f599859a4bc696e
Size

587KB
Sample

211025-a4pl3agdbk
MD5

fc1daa5616198e9202e4f34f9d152608
SHA1

5963d0ef92c86627afa299b30c1e5eee05fa2956
SHA256

9a8da0f07d1b4c6f775eb968b68eb6f48b5e00869232822e4f599859a4bc696e
SHA512

b2bbb767a2735dcdc1637da59cdd96bed738825770e720892d66aba0d8f2991a88488892f9552f082ac831320cefc381896dd3333b5e41a7b5fa62cf259c8bc2

Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  9a8da0f07d1b4c6f775eb968b68eb6f48b5e00869232822e4f599859a4bc696e
- Size
  
  587KB
- MD5
  
  fc1daa5616198e9202e4f34f9d152608
- SHA1
  
  5963d0ef92c86627afa299b30c1e5eee05fa2956
- SHA256
  
  9a8da0f07d1b4c6f775eb968b68eb6f48b5e00869232822e4f599859a4bc696e
- SHA512
  
  b2bbb767a2735dcdc1637da59cdd96bed738825770e720892d66aba0d8f2991a88488892f9552f082ac831320cefc381896dd3333b5e41a7b5fa62cf259c8bc2
Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon7ebf9b416b72a203df65383eec899dc689d2c3d7stealer