Overview

overview

10

Static

static

c37cf9819c...cb.exe

windows7_x64

10

c37cf9819c...cb.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c37cf9819c1ec00aa4c72120dc5b38cb
  • Size 379KB
  • Sample211204-amsmdshfaq
  • SHA256 5f131a6fd46a437ab6cfaf7ea0a554c9c9248ac8aaec7770a0f8395817ed7321
  • MD5 SHA1 SHA512
Score
10/10
raccoon19fa7b704b90f1b3551823fbce7e271aeff8c17fstealer

Malware Config

Extracted

Family

  • raccoon

Version

  • 1.8.3-hotfix

Botnet

  • 19fa7b704b90f1b3551823fbce7e271aeff8c17f

Attributes
  • url4cnc

    http://185.225.19.18/gold3nsun

    http://91.219.237.227/gold3nsun

    https://t.me/gold3nsun

rc4.plain
rc4.plain

Targets

    • Target
      c37cf9819c1ec00aa4c72120dc5b38cb
    • Size 379KB
    • SHA256 5f131a6fd46a437ab6cfaf7ea0a554c9c9248ac8aaec7770a0f8395817ed7321
    • MD5 SHA1 SHA512
    Score
    10/10
    raccoon19fa7b704b90f1b3551823fbce7e271aeff8c17fstealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks