General

  • Target

    6524ee3db299399fb8942869050b092f86970530ffeed461ef82206008b19061

  • Size

    518KB

  • Sample

    220313-wwm9xsbbhm

  • MD5

    9392ffe59b5d7bd3a578a28f915e3473

  • SHA1

    ae9d30ad50003bb7f2b15d665a63925d74d36062

  • SHA256

    6524ee3db299399fb8942869050b092f86970530ffeed461ef82206008b19061

  • SHA512

    2c801d5542be5db3082edd8023df6ef36c6d381d0e2913e62a77ac2e7efc307f48df3aa84745f1030a51bb818010a858c486a0a279efbc4a31fbb705e0cff413

Malware Config

Extracted

Family

raccoon

Botnet

1c0fad6805a0f65d7b597130eb9f089ffbe9857d

Attributes
  • url4cnc

    http://194.180.191.241/capibar

    http://103.155.93.35/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Targets

    • Target

      6524ee3db299399fb8942869050b092f86970530ffeed461ef82206008b19061

    • Size

      518KB

    • MD5

      9392ffe59b5d7bd3a578a28f915e3473

    • SHA1

      ae9d30ad50003bb7f2b15d665a63925d74d36062

    • SHA256

      6524ee3db299399fb8942869050b092f86970530ffeed461ef82206008b19061

    • SHA512

      2c801d5542be5db3082edd8023df6ef36c6d381d0e2913e62a77ac2e7efc307f48df3aa84745f1030a51bb818010a858c486a0a279efbc4a31fbb705e0cff413

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

      suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

    • suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6

      suricata: ET MALWARE Win32.Raccoon Stealer Checkin M6

MITRE ATT&CK Matrix

Tasks