raccoon | 549ea2f1034faedb47940aabbe2e36c8d26f19169f1eb7da48862993f4694514 | Triage

Sharing

General

Target

549ea2f1034faedb47940aabbe2e36c8d26f19169f1eb7da48862993f4694514
Size

493KB
Sample

211026-nnb8pahcd4
MD5

80e026b5f439ba1d82e5a3dd255f56c3
SHA1

ae56fadcea400715ff63f7ffa649b1cd989478f4
SHA256

549ea2f1034faedb47940aabbe2e36c8d26f19169f1eb7da48862993f4694514
SHA512

d019711a4cf61ad87ccf5d62dc0884aa8d6b930165f05fd8c8f1b764c90715954f105dbf575d117ad80c5dd1a5c9d050a22e99d087b77fb864a30793f045bed6

Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer

Malware Config

Extracted

Family

raccoon

Botnet

7ebf9b416b72a203df65383eec899dc689d2c3d7

Attributes

url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  549ea2f1034faedb47940aabbe2e36c8d26f19169f1eb7da48862993f4694514
- Size
  
  493KB
- MD5
  
  80e026b5f439ba1d82e5a3dd255f56c3
- SHA1
  
  ae56fadcea400715ff63f7ffa649b1cd989478f4
- SHA256
  
  549ea2f1034faedb47940aabbe2e36c8d26f19169f1eb7da48862993f4694514
- SHA512
  
  d019711a4cf61ad87ccf5d62dc0884aa8d6b930165f05fd8c8f1b764c90715954f105dbf575d117ad80c5dd1a5c9d050a22e99d087b77fb864a30793f045bed6
Score

10^/10

raccoon 7ebf9b416b72a203df65383eec899dc689d2c3d7 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon7ebf9b416b72a203df65383eec899dc689d2c3d7stealer