Overview

overview

10

Static

static

a1d15701e7...c8.exe

windows7_x64

10

a1d15701e7...c8.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a1d15701e7d521d9a9ed1c4b37a86cc8.exe
  • Size 401KB
  • Sample220101-j7arragacj
  • SHA256 f12e6cd63a8d0c79621de6f617a1d5d58a811bc5e9a5798aa7fdb2b6fc067971
  • MD5 SHA1 SHA512
Score
10/10
raccoond6ee977d17e48189475aba8df49f69c7b76b5fa6stealer

Malware Config

Extracted

Family

  • raccoon

Botnet

  • d6ee977d17e48189475aba8df49f69c7b76b5fa6

Attributes
  • url4cnc

    http://185.163.204.21/charlyl12te

    http://178.62.127.193/charlyl12te

    http://5.181.156.155/charlyl12te

    http://185.163.45.70/charlyl12te

    http://185.163.204.22/charlyl12te

    http://178.62.113.205/charlyl12te

    https://t.me/charlyl12te

rc4.plain
rc4.plain

Targets

    • Target
      a1d15701e7d521d9a9ed1c4b37a86cc8.exe
    • Size 401KB
    • SHA256 f12e6cd63a8d0c79621de6f617a1d5d58a811bc5e9a5798aa7fdb2b6fc067971
    • MD5 SHA1 SHA512
    Score
    10/10
    raccoond6ee977d17e48189475aba8df49f69c7b76b5fa6stealer

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks