raccoon | 5ba5b414db791261a4f7f391449760e9bc6849be47ae04f7a9df3d3ba02d640f | Triage

Sharing

General

Target

5ba5b414db791261a4f7f391449760e9bc6849be47ae04f7a9df3d3ba02d640f
Size

425KB
Sample

211102-wkajpaccf8
MD5

4304a25ae2790c7ccc702465097aedec
SHA1

616df3dc087bfadd6fd45986c4f7b58054b750b6
SHA256

5ba5b414db791261a4f7f391449760e9bc6849be47ae04f7a9df3d3ba02d640f
SHA512

6410055a816fda63b61b584489d7c8fa2fd2908ec2cf1ccc554b10460d00cab30625c9ca05851163a68f83b8be739af126e7b04ab4215f65238875f27b893d7d

Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer

Malware Config

Extracted

Family

raccoon

Botnet

68e2d75238f7c69859792d206401b6bde2b2515c

Attributes

url4cnc
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  5ba5b414db791261a4f7f391449760e9bc6849be47ae04f7a9df3d3ba02d640f
- Size
  
  425KB
- MD5
  
  4304a25ae2790c7ccc702465097aedec
- SHA1
  
  616df3dc087bfadd6fd45986c4f7b58054b750b6
- SHA256
  
  5ba5b414db791261a4f7f391449760e9bc6849be47ae04f7a9df3d3ba02d640f
- SHA512
  
  6410055a816fda63b61b584489d7c8fa2fd2908ec2cf1ccc554b10460d00cab30625c9ca05851163a68f83b8be739af126e7b04ab4215f65238875f27b893d7d
Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon68e2d75238f7c69859792d206401b6bde2b2515cstealer