raccoon

General

Target

82a730933d3fe64cc9c17cd1144e99ce
Size

11.7MB
Sample

220802-1ay7hsdagl
MD5

82a730933d3fe64cc9c17cd1144e99ce
SHA1

bb87afc579bbeb0cf820b99b5ce3af84dd8f646a
SHA256

4cce0df1d375da9741814d70f117deee67d1beab317fb746d3ebefdcb8dff90c
SHA512

c8107b24896a95b03496e03fc631aa12d9ca02b911a5bad6439cf5bc61372b3120b6dab3c5d81607f2ac165408ae9f208a0b0ece8beb0dfc218897d201ec1005

Score

10^/10

Malware Config

Extracted

Family

raccoon

Botnet

517bb0d640c1242c3f069aab3d1018d6

C2

http://51.195.166.178/

rc4.plain

Targets

- Target
  
  82a730933d3fe64cc9c17cd1144e99ce
- Size
  
  11.7MB
- MD5
  
  82a730933d3fe64cc9c17cd1144e99ce
- SHA1
  
  bb87afc579bbeb0cf820b99b5ce3af84dd8f646a
- SHA256
  
  4cce0df1d375da9741814d70f117deee67d1beab317fb746d3ebefdcb8dff90c
- SHA512
  
  c8107b24896a95b03496e03fc631aa12d9ca02b911a5bad6439cf5bc61372b3120b6dab3c5d81607f2ac165408ae9f208a0b0ece8beb0dfc218897d201ec1005
Score

10^/10

raccoon 517bb0d640c1242c3f069aab3d1018d6 discovery spyware stealer
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Raccoon Stealer payload
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Raccoon Stealer payload

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2