0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a

General
Target

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a

Size

1MB

Sample

220520-d8832sgca7

Score
10 /10
MD5

67fb804e2e006ac7fdb5ec617f43aa35

SHA1

6b82e6290ef6d0141f26acde06fa7e2096fb46b2

SHA256

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a

SHA512

721ea1beda72977b30cef1a929bb371e9d3808ff01a0cbb7653329f8e9aa227385dd6971409f62d9029e9372ad4e03da96635b407786c42180992c837b583a7d

Malware Config

Extracted

Family azorult
C2

http://195.245.112.115/index.php

Extracted

Family oski
C2

mantis.ug

Extracted

Family raccoon
Botnet 180d3985eb74eacf2de83c771fbf30a60f670ec0
Attributes
url4cnc
https://telete.in/jrikitiki
rc4.plain
rc4.plain
Targets
Target

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a

MD5

67fb804e2e006ac7fdb5ec617f43aa35

Filesize

1MB

Score
10/10
SHA1

6b82e6290ef6d0141f26acde06fa7e2096fb46b2

SHA256

0e84226430bd428b5dd2f9ceb5cddba56ad3f6606a0b7bf978484132d753aa9a

SHA512

721ea1beda72977b30cef1a929bb371e9d3808ff01a0cbb7653329f8e9aa227385dd6971409f62d9029e9372ad4e03da96635b407786c42180992c837b583a7d

Tags

Signatures

  • Azorult

    Description

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    Tags

  • Oski

    Description

    Oski is an infostealer targeting browser data, crypto wallets.

    Tags

  • Raccoon

    Description

    Simple but powerful infostealer which was very active in 2019.

    Tags

  • Raccoon Stealer Payload

  • Executes dropped EXE

  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery
  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation