raccoon | d1925cda0fe51d1c45e35125248179d9d03a195592c1c36a72c03bd77d1def2b | Triage

Sharing

General

Target

d1925cda0fe51d1c45e35125248179d9d03a195592c1c36a72c03bd77d1def2b
Size

489KB
Sample

211026-hgz4aahgen
MD5

a4ee62e8c1105e214d4ddf796b501c34
SHA1

91d2be2b407ffaab533e899c44534b500b9e4196
SHA256

d1925cda0fe51d1c45e35125248179d9d03a195592c1c36a72c03bd77d1def2b
SHA512

5b7347735632f24854fe3a1b0d811ee8ead738d011dbf47cea7277ffe17c9507a4ea973828d71680521716047485ec7c92993ed5d615c8bc4c7458e10734f8e6

Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  d1925cda0fe51d1c45e35125248179d9d03a195592c1c36a72c03bd77d1def2b
- Size
  
  489KB
- MD5
  
  a4ee62e8c1105e214d4ddf796b501c34
- SHA1
  
  91d2be2b407ffaab533e899c44534b500b9e4196
- SHA256
  
  d1925cda0fe51d1c45e35125248179d9d03a195592c1c36a72c03bd77d1def2b
- SHA512
  
  5b7347735632f24854fe3a1b0d811ee8ead738d011dbf47cea7277ffe17c9507a4ea973828d71680521716047485ec7c92993ed5d615c8bc4c7458e10734f8e6
Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon7ebf9b416b72a203df65383eec899dc689d2c3d7stealer