raccoon | b6be56f176f5dbcca9337affb0eb8d53c8c663c951a3485d37036c513cb5f794 | Triage

Sharing

General

Target

b6be56f176f5dbcca9337affb0eb8d53c8c663c951a3485d37036c513cb5f794
Size

424KB
Sample

211102-158pfacfg9
MD5

542f15491e8adf5f45083aacd9daabde
SHA1

25e6628b8cf3b0a79fe60abad97fe75ae22aa089
SHA256

b6be56f176f5dbcca9337affb0eb8d53c8c663c951a3485d37036c513cb5f794
SHA512

52706a28e51639a735c70d33eebf43e0e14a61d93a8c5ca7a81f81992522ef12f0ea7623a0b4aeeebf8f7e1337785e3dcb8f7904959b802e8de7a27d61622567

Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer

Malware Config

Extracted

Family

raccoon

Botnet

68e2d75238f7c69859792d206401b6bde2b2515c

Attributes

url4cnc
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  b6be56f176f5dbcca9337affb0eb8d53c8c663c951a3485d37036c513cb5f794
- Size
  
  424KB
- MD5
  
  542f15491e8adf5f45083aacd9daabde
- SHA1
  
  25e6628b8cf3b0a79fe60abad97fe75ae22aa089
- SHA256
  
  b6be56f176f5dbcca9337affb0eb8d53c8c663c951a3485d37036c513cb5f794
- SHA512
  
  52706a28e51639a735c70d33eebf43e0e14a61d93a8c5ca7a81f81992522ef12f0ea7623a0b4aeeebf8f7e1337785e3dcb8f7904959b802e8de7a27d61622567
Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon68e2d75238f7c69859792d206401b6bde2b2515cstealer