raccoon | a7d363cccac12b7aa550b0ddb47266b8a7450edd637826762e5b598bd1b11fc3 | Triage

Sharing

General

Target

a7d363cccac12b7aa550b0ddb47266b8a7450edd637826762e5b598bd1b11fc3
Size

538KB
Sample

211102-3zlntscgg2
MD5

5ddc3eb7b9f8d21218c471e5f94ee962
SHA1

1b29963e4989b675f1ccd269d44391df10fdd5c8
SHA256

a7d363cccac12b7aa550b0ddb47266b8a7450edd637826762e5b598bd1b11fc3
SHA512

f1fe62ca7c402d3ced67c382083ff3559dc0f00448f6776f3a1c9696b267860b0fec4773f8191d653144dcb815646d3d0f40c1cb365e1beec8ef3de2f7cba16a

Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer

Malware Config

Extracted

Family

raccoon

Botnet

68e2d75238f7c69859792d206401b6bde2b2515c

Attributes

url4cnc
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  a7d363cccac12b7aa550b0ddb47266b8a7450edd637826762e5b598bd1b11fc3
- Size
  
  538KB
- MD5
  
  5ddc3eb7b9f8d21218c471e5f94ee962
- SHA1
  
  1b29963e4989b675f1ccd269d44391df10fdd5c8
- SHA256
  
  a7d363cccac12b7aa550b0ddb47266b8a7450edd637826762e5b598bd1b11fc3
- SHA512
  
  f1fe62ca7c402d3ced67c382083ff3559dc0f00448f6776f3a1c9696b267860b0fec4773f8191d653144dcb815646d3d0f40c1cb365e1beec8ef3de2f7cba16a
Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon68e2d75238f7c69859792d206401b6bde2b2515cstealer