Overview

overview

10

Static

static

2afcb892c0...15.exe

windows7_x64

10

2afcb892c0...15.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2afcb892c0114000ef9664e45d1aea15.exe

  • Size

    465KB

  • Sample

    211027-nv62msefb4

  • MD5

    2afcb892c0114000ef9664e45d1aea15

  • SHA1

    b6f0dd26ffce6dd5cd74779cdd61b208ed0a6414

  • SHA256

    d004a793d71800e6358a7dc5322b8bc226739828bb9dfe8d2f62387412670d70

  • SHA512

    e7d702abc0b7c130b5d26736701597998cf0c55ce5533806a23380c742416be7a59b49f391ea2cff0a3fc75984ba3714506a918a32077944ddb0c0ef745395b5

Score
10/10
raccoon60e59be328fbd2ebac1839ea99411dccb00a6f49stealer

Malware Config

Extracted

Family

raccoon

Botnet

60e59be328fbd2ebac1839ea99411dccb00a6f49

Attributes
  • url4cnc

    http://telegin.top/agrybirdsgamerept

    http://ttmirror.top/agrybirdsgamerept

    http://teletele.top/agrybirdsgamerept

    http://telegalive.top/agrybirdsgamerept

    http://toptelete.top/agrybirdsgamerept

    http://telegraf.top/agrybirdsgamerept

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Targets

    • Target

      2afcb892c0114000ef9664e45d1aea15.exe

    • Size

      465KB

    • MD5

      2afcb892c0114000ef9664e45d1aea15

    • SHA1

      b6f0dd26ffce6dd5cd74779cdd61b208ed0a6414

    • SHA256

      d004a793d71800e6358a7dc5322b8bc226739828bb9dfe8d2f62387412670d70

    • SHA512

      e7d702abc0b7c130b5d26736701597998cf0c55ce5533806a23380c742416be7a59b49f391ea2cff0a3fc75984ba3714506a918a32077944ddb0c0ef745395b5

    Score
    10/10
    raccoon60e59be328fbd2ebac1839ea99411dccb00a6f49stealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks