Overview

overview

10

Static

static

7

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e7e69cd1c9b24f6a36870ec5ae6c31c69022fb48d3fdf59bcda5c1528bc9c04

  • Size

    4.1MB

  • Sample

    220610-qc14sabdaq

  • MD5

    361082e2534e6bf2faa27de1fd76492a

  • SHA1

    5f2f00698de0a9f6f5b31bf495cf12597c510f7c

  • SHA256

    6e7e69cd1c9b24f6a36870ec5ae6c31c69022fb48d3fdf59bcda5c1528bc9c04

  • SHA512

    43b9ba0e2636f6f2ad726fe4d71b2e44e96e4ecf413c1f544bd245ba64f1cca7056372602b9bfd6f1f0174e05bcc2894cfbfdbf451e007d6d96e566d44a2d436

Score
10/10
raccoon5dbb6dd0ee6f4515b2788cf3204b96afevasionstealerthemidatrojan

Malware Config

Extracted

Family

raccoon

Botnet

5dbb6dd0ee6f4515b2788cf3204b96af

C2

http://185.227.111.81/

rc4.plain
rc4.plain

Targets

    • Target

      6e7e69cd1c9b24f6a36870ec5ae6c31c69022fb48d3fdf59bcda5c1528bc9c04

    • Size

      4.1MB

    • MD5

      361082e2534e6bf2faa27de1fd76492a

    • SHA1

      5f2f00698de0a9f6f5b31bf495cf12597c510f7c

    • SHA256

      6e7e69cd1c9b24f6a36870ec5ae6c31c69022fb48d3fdf59bcda5c1528bc9c04

    • SHA512

      43b9ba0e2636f6f2ad726fe4d71b2e44e96e4ecf413c1f544bd245ba64f1cca7056372602b9bfd6f1f0174e05bcc2894cfbfdbf451e007d6d96e566d44a2d436

    Score
    10/10
    raccoon5dbb6dd0ee6f4515b2788cf3204b96afevasionstealerthemidatrojan

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks