General
-
Target
00FC3CD6E8696CF8EEA722198A6B7469.fil
-
Size
5.5MB
-
Sample
220729-xjt3dachfq
-
MD5
00fc3cd6e8696cf8eea722198a6b7469
-
SHA1
0f1b48ef3dab7a257ded76e016eb02ab6100218a
-
SHA256
2142d70eae48bea2173d8a1d161daa71546ae8a27e2719f0f013b723ffe7a0ec
-
SHA512
80f998440901e10637618056c9ce153682185ee1f66196a914c6ea9f870add90305547cd611cace3d0e74696bae7e8c9ea283780682286a3c392c4e259d0dec0
Behavioral task
behavioral1
Sample
00FC3CD6E8696CF8EEA722198A6B7469.exe
Resource
win7-20220718-en
Malware Config
Extracted
raccoon
d498b1632d1cef90118cd87314063540
http://80.66.87.43/
Targets
-
-
Target
00FC3CD6E8696CF8EEA722198A6B7469.fil
-
Size
5.5MB
-
MD5
00fc3cd6e8696cf8eea722198a6b7469
-
SHA1
0f1b48ef3dab7a257ded76e016eb02ab6100218a
-
SHA256
2142d70eae48bea2173d8a1d161daa71546ae8a27e2719f0f013b723ffe7a0ec
-
SHA512
80f998440901e10637618056c9ce153682185ee1f66196a914c6ea9f870add90305547cd611cace3d0e74696bae7e8c9ea283780682286a3c392c4e259d0dec0
-
Raccoon Stealer payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-