Overview

overview

10

Static

static

file.html

windows7-x64

1

file.html

windows10-1703-x64

10

file.html

windows10-2004-x64

1

file.html

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file

  • Size

    305KB

  • Sample

    220729-msptxahebl

  • MD5

    d89d3c3cea154915a742bf8b52abe43d

  • SHA1

    acb97f43a1e6e8602e8d12418e5b5b71a2a1b083

  • SHA256

    78bcdef2a920a1927fee569803826bae3425e507d354eac71136b2a103abdb24

  • SHA512

    344cce22843772d22e37d543d698498e335048e3fe9f07bcf380b99f26f53847ab25c185f3ec4ed2319d738c9dfe3b71ce4f70f93d971dc4f13ceafbe1f260bf

Score
10/10
raccoon832badce9b2e1756260c5ffcba9a576fevasionspywarestealerthemida

Malware Config

Extracted

Family

raccoon

Botnet

832badce9b2e1756260c5ffcba9a576f

C2

http://51.195.166.175/

rc4.plain

Targets

    • Target

      file

    • Size

      305KB

    • MD5

      d89d3c3cea154915a742bf8b52abe43d

    • SHA1

      acb97f43a1e6e8602e8d12418e5b5b71a2a1b083

    • SHA256

      78bcdef2a920a1927fee569803826bae3425e507d354eac71136b2a103abdb24

    • SHA512

      344cce22843772d22e37d543d698498e335048e3fe9f07bcf380b99f26f53847ab25c185f3ec4ed2319d738c9dfe3b71ce4f70f93d971dc4f13ceafbe1f260bf

    Score
    10/10
    raccoon832badce9b2e1756260c5ffcba9a576fevasionspywarestealerthemida

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks