General

  • Target

    43522817802fcb9984f3353cdcaa1a2c45d01bc224ead06573ec2634c775f855

  • Size

    26.3MB

  • Sample

    220508-tardcabcb4

  • MD5

    72510551c596915bceb6a99a13fda5b2

  • SHA1

    12e3d3789778624d0db0657aeb0118f64928a331

  • SHA256

    43522817802fcb9984f3353cdcaa1a2c45d01bc224ead06573ec2634c775f855

  • SHA512

    3a74fbf31e4761cb9a06c174125cac91395f40c265fba0deb52617d93417e1b428de286a3840fd5b0fe9f430c1e9eb995908d071f7583467797ecf70b1f59c91

Malware Config

Extracted

Family

raccoon

Botnet

c763e433ef51ff4b6c545800e4ba3b3b1a2ea077

Attributes
  • url4cnc

    https://telete.in/jbitchsucks

rc4.plain
rc4.plain

Targets

    • Target

      43522817802fcb9984f3353cdcaa1a2c45d01bc224ead06573ec2634c775f855

    • Size

      26.3MB

    • MD5

      72510551c596915bceb6a99a13fda5b2

    • SHA1

      12e3d3789778624d0db0657aeb0118f64928a331

    • SHA256

      43522817802fcb9984f3353cdcaa1a2c45d01bc224ead06573ec2634c775f855

    • SHA512

      3a74fbf31e4761cb9a06c174125cac91395f40c265fba0deb52617d93417e1b428de286a3840fd5b0fe9f430c1e9eb995908d071f7583467797ecf70b1f59c91

    • Modifies Windows Defender Real-time Protection settings

    • Modifies security service

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

    • Raccoon Stealer Payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

2
T1031

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Tasks