Overview

overview

10

Static

static

8

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    056a3022c5e70d112e82844d1101e1a591b02960ae0609f06e9930a3f3bd6efa

  • Size

    4.5MB

  • Sample

    220610-y6vg4afbgj

  • MD5

    8b816302b43bc9e9b6ac2c694459a420

  • SHA1

    d52fc1485c86843bd3e4166ebc1ef4f9a1732579

  • SHA256

    056a3022c5e70d112e82844d1101e1a591b02960ae0609f06e9930a3f3bd6efa

  • SHA512

    a7e429e911af551af026f3a18d5845d1d032d5dbd39af17fec94917368c971682742791adff212c3d36e52d0c682a87a5c5262fc2019690e5f07b259738bac5c

Score
10/10
raccoon2e76ef3db69c0aaf1af8319ea2bd6e91evasionstealersuricatathemidatrojanvmprotect

Malware Config

Extracted

Family

raccoon

Botnet

2e76ef3db69c0aaf1af8319ea2bd6e91

C2

http://185.106.94.148/

rc4.plain
rc4.plain

Targets

    • Target

      056a3022c5e70d112e82844d1101e1a591b02960ae0609f06e9930a3f3bd6efa

    • Size

      4.5MB

    • MD5

      8b816302b43bc9e9b6ac2c694459a420

    • SHA1

      d52fc1485c86843bd3e4166ebc1ef4f9a1732579

    • SHA256

      056a3022c5e70d112e82844d1101e1a591b02960ae0609f06e9930a3f3bd6efa

    • SHA512

      a7e429e911af551af026f3a18d5845d1d032d5dbd39af17fec94917368c971682742791adff212c3d36e52d0c682a87a5c5262fc2019690e5f07b259738bac5c

    Score
    10/10
    raccoon2e76ef3db69c0aaf1af8319ea2bd6e91evasionstealersuricatathemidatrojanvmprotect

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • suricata: ET MALWARE Generic Stealer Config Download Request

      suricata: ET MALWARE Generic Stealer Config Download Request

      suricata

    • suricata: ET MALWARE Possible Drive DDoS Check-in

      suricata: ET MALWARE Possible Drive DDoS Check-in

      suricata

    • suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

      suricata: ET MALWARE Recordbreaker Stealer CnC Checkin

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

      suricata: ET MALWARE Win32/RecordBreaker CnC Checkin

      suricata

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks