raccoon | ec24adc7af8c097ca5969d4f9c8758790d1a5457612a79f378f5746a5d308bcb | Triage

Sharing

General

Target

ec24adc7af8c097ca5969d4f9c8758790d1a5457612a79f378f5746a5d308bcb
Size

431KB
Sample

211102-lvhb6sccd5
MD5

f27ddbd36de9c3f46005b35422fee78a
SHA1

ec2bded44153bd16704cded527ba1a4301c91207
SHA256

ec24adc7af8c097ca5969d4f9c8758790d1a5457612a79f378f5746a5d308bcb
SHA512

4f1bd8d4c312aa57801f8cfb79a7c87631fb2bbac4bd0f440844e6c59f165ef0b962a2d48068b507363d40c86fb067e24f82f3bf80c1f8288899f926dd98fea6

Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer

Malware Config

Extracted

Family

raccoon

Botnet

68e2d75238f7c69859792d206401b6bde2b2515c

Attributes

url4cnc
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  ec24adc7af8c097ca5969d4f9c8758790d1a5457612a79f378f5746a5d308bcb
- Size
  
  431KB
- MD5
  
  f27ddbd36de9c3f46005b35422fee78a
- SHA1
  
  ec2bded44153bd16704cded527ba1a4301c91207
- SHA256
  
  ec24adc7af8c097ca5969d4f9c8758790d1a5457612a79f378f5746a5d308bcb
- SHA512
  
  4f1bd8d4c312aa57801f8cfb79a7c87631fb2bbac4bd0f440844e6c59f165ef0b962a2d48068b507363d40c86fb067e24f82f3bf80c1f8288899f926dd98fea6
Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon68e2d75238f7c69859792d206401b6bde2b2515cstealer