Overview

overview

10

Static

static

10

0x00060000...58.exe

windows7-x64

10

0x00060000...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x0006000000008527-58.dat

  • Size

    727.3MB

  • Sample

    220805-pa6e2sabfn

  • MD5

    881cbc2da4c6467aec519f4909371af8

  • SHA1

    ec9c0f602456802254ac2659cd0b42ef97d32b62

  • SHA256

    dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5

  • SHA512

    e1d3221d3663e09b8258a4b3ad77a201e18a7cc880b359edf1dd9a2123ed48c6b4888f27f7f9bad9b2da6328f5211fe709e94195e76288c9255997612415b098

Score
10/10
raccoon517bb0d640c1242c3f069aab3d1018d6discoveryspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

517bb0d640c1242c3f069aab3d1018d6

C2

http://51.195.166.178/

rc4.plain

Targets

    • Target

      0x0006000000008527-58.dat

    • Size

      727.3MB

    • MD5

      881cbc2da4c6467aec519f4909371af8

    • SHA1

      ec9c0f602456802254ac2659cd0b42ef97d32b62

    • SHA256

      dce4e4783ab5819869baae8b98812aabe7654ba2ff9d1e033548a52af93e89a5

    • SHA512

      e1d3221d3663e09b8258a4b3ad77a201e18a7cc880b359edf1dd9a2123ed48c6b4888f27f7f9bad9b2da6328f5211fe709e94195e76288c9255997612415b098

    Score
    10/10
    raccoon517bb0d640c1242c3f069aab3d1018d6discoveryspywarestealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer payload

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks