Overview

overview

10

Static

static

e06560a59e...4e.exe

windows7_x64

10

e06560a59e...4e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e06560a59ef45723eb8bfc654cf7c73cb7fb3bcaed856d9dc9465e8942d4064e

  • Size

    21.1MB

  • Sample

    220330-h7fgkahhf6

  • MD5

    379ae673167293cf2986d4351dd5d97f

  • SHA1

    5e7e9277a56ccc3e9a2f9bd1c4c5071af6fb3405

  • SHA256

    e06560a59ef45723eb8bfc654cf7c73cb7fb3bcaed856d9dc9465e8942d4064e

  • SHA512

    b38d774199bb7f41dde4424f3c592c5f60bc3584974bd1d145f86223644e6cb76eb19c834c2575db6618529a1cbb782cb19f2a3f6555518a867bd73db8afc174

Score
10/10
raccoon5eaa41b3101d5537f786a35da1878f0d1d760e53evasionstealertrojanupx

Malware Config

Extracted

Family

raccoon

Version

1.7.1-hotfix

Botnet

5eaa41b3101d5537f786a35da1878f0d1d760e53

Attributes
  • url4cnc

    https://telete.in/jbitchsucks

rc4.plain
rc4.plain

Targets

    • Target

      e06560a59ef45723eb8bfc654cf7c73cb7fb3bcaed856d9dc9465e8942d4064e

    • Size

      21.1MB

    • MD5

      379ae673167293cf2986d4351dd5d97f

    • SHA1

      5e7e9277a56ccc3e9a2f9bd1c4c5071af6fb3405

    • SHA256

      e06560a59ef45723eb8bfc654cf7c73cb7fb3bcaed856d9dc9465e8942d4064e

    • SHA512

      b38d774199bb7f41dde4424f3c592c5f60bc3584974bd1d145f86223644e6cb76eb19c834c2575db6618529a1cbb782cb19f2a3f6555518a867bd73db8afc174

    Score
    10/10
    raccoon5eaa41b3101d5537f786a35da1878f0d1d760e53evasionstealertrojanupx

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • Raccoon Stealer Payload

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

3
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks