raccoon | 165a11bf035ca492c0e1d2ea831dda0b20369b8cf8f284dc68f07457b1fe2fed | Triage

Sharing

General

Target

165a11bf035ca492c0e1d2ea831dda0b20369b8cf8f284dc68f07457b1fe2fed
Size

482KB
Sample

211026-kpbf1ahad3
MD5

2fe5375a3969e498402a04caa5a62f33
SHA1

ec76a8e802f406b0e3026a672c264d37708ac9ae
SHA256

165a11bf035ca492c0e1d2ea831dda0b20369b8cf8f284dc68f07457b1fe2fed
SHA512

af1878411d7c3d05aebbab7004e557684732b1b9ff0e94ab585bdd748e6877ac34972a330cffb320fb0a14affb8c42c8ca77e4522aeedcecb66c26a765f2cc84

Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  165a11bf035ca492c0e1d2ea831dda0b20369b8cf8f284dc68f07457b1fe2fed
- Size
  
  482KB
- MD5
  
  2fe5375a3969e498402a04caa5a62f33
- SHA1
  
  ec76a8e802f406b0e3026a672c264d37708ac9ae
- SHA256
  
  165a11bf035ca492c0e1d2ea831dda0b20369b8cf8f284dc68f07457b1fe2fed
- SHA512
  
  af1878411d7c3d05aebbab7004e557684732b1b9ff0e94ab585bdd748e6877ac34972a330cffb320fb0a14affb8c42c8ca77e4522aeedcecb66c26a765f2cc84
Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon7ebf9b416b72a203df65383eec899dc689d2c3d7stealer