General
-
Target
Setup.exe
-
Size
396.0MB
-
Sample
220804-n87kbsffdr
-
MD5
e5e62628c45c3ddb68cb1ac7b1d9ef6b
-
SHA1
52ff4607f24e1f0623682e4d756b5f29bc213ca0
-
SHA256
4830e0dc4af8e724ba266c00e2d8d531cde41ad8836d13c9b9939ba28f7a9888
-
SHA512
b6b3b7208024c18d0ba66d54e39341f0450ba92f3b39012b80fcae89e27e617cfb9ba05b678c3a7d55ecf14b5175e52572773c3ec91b29912df56c09e6d152c9
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220718-en
Malware Config
Extracted
raccoon
8eb14caca01131f5f4ff62ef8a0fcab4
http://5.252.23.112/
http://45.153.230.5/
Targets
-
-
Target
Setup.exe
-
Size
396.0MB
-
MD5
e5e62628c45c3ddb68cb1ac7b1d9ef6b
-
SHA1
52ff4607f24e1f0623682e4d756b5f29bc213ca0
-
SHA256
4830e0dc4af8e724ba266c00e2d8d531cde41ad8836d13c9b9939ba28f7a9888
-
SHA512
b6b3b7208024c18d0ba66d54e39341f0450ba92f3b39012b80fcae89e27e617cfb9ba05b678c3a7d55ecf14b5175e52572773c3ec91b29912df56c09e6d152c9
-
Raccoon Stealer payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-