General

  • Target

    7a92936ecb15e636ee9b3e4100baf0e9560285b9efb612f357de1df2613e1184

  • Size

    425KB

  • Sample

    211102-srbtjscag2

  • MD5

    b42f47881b247249a635b33804894ddf

  • SHA1

    6bbd8790d80cb084ad922c28109ad6a653635a13

  • SHA256

    7a92936ecb15e636ee9b3e4100baf0e9560285b9efb612f357de1df2613e1184

  • SHA512

    ed2e47d7176940822b1039fa8d2a9ba2ebcea6e7e8181f179676296da56afc51087347fe88b041ccad12b6cd5cd15af7bcf5af2df1912df82a1aa17132c24526

Malware Config

Extracted

Family

raccoon

Botnet

68e2d75238f7c69859792d206401b6bde2b2515c

Attributes
  • url4cnc

    http://telegalive.top/agrybirdsgamerept

    http://toptelete.top/agrybirdsgamerept

    http://telegraf.top/agrybirdsgamerept

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Targets

    • Target

      7a92936ecb15e636ee9b3e4100baf0e9560285b9efb612f357de1df2613e1184

    • Size

      425KB

    • MD5

      b42f47881b247249a635b33804894ddf

    • SHA1

      6bbd8790d80cb084ad922c28109ad6a653635a13

    • SHA256

      7a92936ecb15e636ee9b3e4100baf0e9560285b9efb612f357de1df2613e1184

    • SHA512

      ed2e47d7176940822b1039fa8d2a9ba2ebcea6e7e8181f179676296da56afc51087347fe88b041ccad12b6cd5cd15af7bcf5af2df1912df82a1aa17132c24526

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Suspicious use of NtCreateProcessExOtherParentProcess

MITRE ATT&CK Matrix

Tasks