raccoon | cdef038f29d914d85e802110833a45fa141e47faafa0ef1857157189a098a2b6 | Triage

Sharing

General

Target

cdef038f29d914d85e802110833a45fa141e47faafa0ef1857157189a098a2b6
Size

538KB
Sample

211103-cf5dqachc8
MD5

1d31ace24f46856e597a1d5727c45fc7
SHA1

7d18eebe19491ae50597950c93b3dbd438b676b4
SHA256

cdef038f29d914d85e802110833a45fa141e47faafa0ef1857157189a098a2b6
SHA512

eeb9978e90056559767f1157b805b142e3fca13bb2fd9080a9115871e11ff0d4a5f30e6ffb735215c92431291b933b08bcb7381bcc5296ea40564970f8aedff2

Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer

Malware Config

Extracted

Family

raccoon

Botnet

68e2d75238f7c69859792d206401b6bde2b2515c

Attributes

url4cnc
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  cdef038f29d914d85e802110833a45fa141e47faafa0ef1857157189a098a2b6
- Size
  
  538KB
- MD5
  
  1d31ace24f46856e597a1d5727c45fc7
- SHA1
  
  7d18eebe19491ae50597950c93b3dbd438b676b4
- SHA256
  
  cdef038f29d914d85e802110833a45fa141e47faafa0ef1857157189a098a2b6
- SHA512
  
  eeb9978e90056559767f1157b805b142e3fca13bb2fd9080a9115871e11ff0d4a5f30e6ffb735215c92431291b933b08bcb7381bcc5296ea40564970f8aedff2
Score

10^/10

raccoon 68e2d75238f7c69859792d206401b6bde2b2515c stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon68e2d75238f7c69859792d206401b6bde2b2515cstealer