raccoon | 00bde1ca13522a0360487b018802b86cfdd54fa2b6006167ca8b19fe27632f26 | Triage

Sharing

General

Target

00bde1ca13522a0360487b018802b86cfdd54fa2b6006167ca8b19fe27632f26
Size

547KB
Sample

211108-bd91ragdak
MD5

a9a7eb469eef113b9c226c9618c9c896
SHA1

23882d2c80d11e121abd70be2670ea1a28c8e599
SHA256

00bde1ca13522a0360487b018802b86cfdd54fa2b6006167ca8b19fe27632f26
SHA512

7e099a64eb9be8d2279f045d68f92160102b5044fe6b10f92d0ee72dc1c6f5be2409bbeea0860611c5ea80c8c3826d0fb9620f44f353afd7993457df5b8ab1de

Score

10^/10

raccoon 243f5e3056753d9f9706258dce4f79e57c3a9c44 stealer

Malware Config

Extracted

Family

raccoon

Version

1.8.3

Botnet

243f5e3056753d9f9706258dce4f79e57c3a9c44

Attributes

url4cnc
http://178.23.190.57/agrybirdsgamerept

http://91.219.236.162/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

http://193.38.54.238/agrybirdsgamerept

http://74.119.192.122/agrybirdsgamerept

http://91.219.236.240/agrybirdsgamerept

rc4.plain

rc4.plain

Targets

- Target
  
  00bde1ca13522a0360487b018802b86cfdd54fa2b6006167ca8b19fe27632f26
- Size
  
  547KB
- MD5
  
  a9a7eb469eef113b9c226c9618c9c896
- SHA1
  
  23882d2c80d11e121abd70be2670ea1a28c8e599
- SHA256
  
  00bde1ca13522a0360487b018802b86cfdd54fa2b6006167ca8b19fe27632f26
- SHA512
  
  7e099a64eb9be8d2279f045d68f92160102b5044fe6b10f92d0ee72dc1c6f5be2409bbeea0860611c5ea80c8c3826d0fb9620f44f353afd7993457df5b8ab1de
Score

10^/10

raccoon 243f5e3056753d9f9706258dce4f79e57c3a9c44 stealer
- Raccoon
  Simple but powerful infostealer which was very active in 2019.
  stealer raccoon
- Suspicious use of NtCreateProcessExOtherParentProcess
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

raccoon243f5e3056753d9f9706258dce4f79e57c3a9c44stealer