General

  • Target

    bba02c2852a21186a15a698400959e8ac31779165e7f8b4b35f796e3dfab0ce0

  • Size

    26.3MB

  • Sample

    220417-r39dhsgchj

  • MD5

    f913308985c97f9147fe02f27adbd89f

  • SHA1

    530c43f6e4a2c8d6e30c683ff4fb5d07808be1a4

  • SHA256

    bba02c2852a21186a15a698400959e8ac31779165e7f8b4b35f796e3dfab0ce0

  • SHA512

    9be33cf734abb5b5b66c423aa1fe6d6c9ce8460411510491870086ed6b89d7122acdcb55414d063fe83bf383828ae90c17db4325902a2681790bf02dc03e6089

Malware Config

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes
  • url4cnc

    https://telete.in/jbitchsucks

rc4.plain
rc4.plain

Targets

    • Target

      bba02c2852a21186a15a698400959e8ac31779165e7f8b4b35f796e3dfab0ce0

    • Size

      26.3MB

    • MD5

      f913308985c97f9147fe02f27adbd89f

    • SHA1

      530c43f6e4a2c8d6e30c683ff4fb5d07808be1a4

    • SHA256

      bba02c2852a21186a15a698400959e8ac31779165e7f8b4b35f796e3dfab0ce0

    • SHA512

      9be33cf734abb5b5b66c423aa1fe6d6c9ce8460411510491870086ed6b89d7122acdcb55414d063fe83bf383828ae90c17db4325902a2681790bf02dc03e6089

    • Modifies Windows Defender Real-time Protection settings

    • Modifies security service

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Raccoon Stealer Payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

2
T1031

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Tasks