raccoon | 355c04a901702b5ae58871bbd85243ea2bc9dd74052f041ee4ebfd0c3ed56bff | Triage

Sharing

General

Target

355c04a901702b5ae58871bbd85243ea2bc9dd74052f041ee4ebfd0c3ed56bff
Size

547KB
Sample

211107-yj9y9sahg3
MD5

6b88d7a1257028d317907eeb2873597e
SHA1

d957243d2f9c90ea1dd8816e2f89abbb06a5f535
SHA256

355c04a901702b5ae58871bbd85243ea2bc9dd74052f041ee4ebfd0c3ed56bff
SHA512

2718cca02eb40d3861ef284526da62d78bd61ab6b8933a1af04c69d17fcdc8475e096d4dba94b126b0290cd6dca2c93a437bb3b2ecd6718fc2ba9bef97eee536

Score

10^/10

raccoon 243f5e3056753d9f9706258dce4f79e57c3a9c44 stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3

Botnet

243f5e3056753d9f9706258dce4f79e57c3a9c44

Attributes

url4cnc
http://178.23.190.57/agrybirdsgamerept

http://91.219.236.162/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

http://193.38.54.238/agrybirdsgamerept

http://74.119.192.122/agrybirdsgamerept

http://91.219.236.240/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  355c04a901702b5ae58871bbd85243ea2bc9dd74052f041ee4ebfd0c3ed56bff
- Size
  
  547KB
- MD5
  
  6b88d7a1257028d317907eeb2873597e
- SHA1
  
  d957243d2f9c90ea1dd8816e2f89abbb06a5f535
- SHA256
  
  355c04a901702b5ae58871bbd85243ea2bc9dd74052f041ee4ebfd0c3ed56bff
- SHA512
  
  2718cca02eb40d3861ef284526da62d78bd61ab6b8933a1af04c69d17fcdc8475e096d4dba94b126b0290cd6dca2c93a437bb3b2ecd6718fc2ba9bef97eee536
Score

10^/10

raccoon 243f5e3056753d9f9706258dce4f79e57c3a9c44 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon243f5e3056753d9f9706258dce4f79e57c3a9c44stealer