Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7cb3aad71cc0c55fe28f65d316c19438e3c54a444ace5caf9fdd50db2c8ffe0b

  • Size

    481KB

  • Sample

    211106-xj7ngafbd8

  • MD5

    10efeb488184d3492301632a9d65713c

  • SHA1

    8ebdb3d70fad0598ac65d58571ef1bb50aed0ccf

  • SHA256

    7cb3aad71cc0c55fe28f65d316c19438e3c54a444ace5caf9fdd50db2c8ffe0b

  • SHA512

    6a95e8bf84ff0e78330e654f7f9fc3dfef146e0e9da5807176785a746b229f65f07b8855ce542601fe1cf9bf09d3550c85fe8e6ff3365b8bb82b8f006dff37f9

Score
10/10
raccoon243f5e3056753d9f9706258dce4f79e57c3a9c44stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3

Botnet

243f5e3056753d9f9706258dce4f79e57c3a9c44

Attributes
  • url4cnc

    http://178.23.190.57/agrybirdsgamerept

    http://91.219.236.162/agrybirdsgamerept

    http://185.163.47.176/agrybirdsgamerept

    http://193.38.54.238/agrybirdsgamerept

    http://74.119.192.122/agrybirdsgamerept

    http://91.219.236.240/agrybirdsgamerept

rc4.plain
rc4.plain

Targets

    • Target

      7cb3aad71cc0c55fe28f65d316c19438e3c54a444ace5caf9fdd50db2c8ffe0b

    • Size

      481KB

    • MD5

      10efeb488184d3492301632a9d65713c

    • SHA1

      8ebdb3d70fad0598ac65d58571ef1bb50aed0ccf

    • SHA256

      7cb3aad71cc0c55fe28f65d316c19438e3c54a444ace5caf9fdd50db2c8ffe0b

    • SHA512

      6a95e8bf84ff0e78330e654f7f9fc3dfef146e0e9da5807176785a746b229f65f07b8855ce542601fe1cf9bf09d3550c85fe8e6ff3365b8bb82b8f006dff37f9

    Score
    10/10
    raccoon243f5e3056753d9f9706258dce4f79e57c3a9c44stealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1

MITRE ATT&CK Matrix

Tasks