raccoon | e79a3f2c28fdf68d4aed9bd0a84841384b9d1519e879fce0d6099c65bc49da80 | Triage

Sharing

General

Target

e79a3f2c28fdf68d4aed9bd0a84841384b9d1519e879fce0d6099c65bc49da80
Size

492KB
Sample

211026-mjvnsshbe6
MD5

6a9ae58cade613c377b3bb2e0be83dbe
SHA1

3cb445f095f3358f9184cb3f09958c6df3f5353a
SHA256

e79a3f2c28fdf68d4aed9bd0a84841384b9d1519e879fce0d6099c65bc49da80
SHA512

52f6959115152d825505790ffa88aba3428f54bcabeed0fa1539615eeb704521e2b315b486ab676babf1f6b9952431b722db72e18fbc2d56742ae001e351d3ca

Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  e79a3f2c28fdf68d4aed9bd0a84841384b9d1519e879fce0d6099c65bc49da80
- Size
  
  492KB
- MD5
  
  6a9ae58cade613c377b3bb2e0be83dbe
- SHA1
  
  3cb445f095f3358f9184cb3f09958c6df3f5353a
- SHA256
  
  e79a3f2c28fdf68d4aed9bd0a84841384b9d1519e879fce0d6099c65bc49da80
- SHA512
  
  52f6959115152d825505790ffa88aba3428f54bcabeed0fa1539615eeb704521e2b315b486ab676babf1f6b9952431b722db72e18fbc2d56742ae001e351d3ca
Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon7ebf9b416b72a203df65383eec899dc689d2c3d7stealer