Overview

overview

10

Static

static

launch.exe

windows7-x64

10

launch.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    launch.exe

  • Size

    6.3MB

  • Sample

    220829-3rxfcshgf6

  • MD5

    a5efe5d52d9088a7e07770d7c7050a4a

  • SHA1

    7906dfa3eb1ddc0536df7b26f0477c29853fe685

  • SHA256

    81ae7aea498cdd4d50470b3dcd54088d7bce5bf5f6019b08d9d558acd190cb4d

  • SHA512

    9069fdb6ae023af7a7ef30796a0633d9e4d073d959f067b4ad73fb625235a3376c110004a2dbc497e9b20935342b77d118c960cb6f7c00ca2d32d67e47c063b0

  • SSDEEP

    98304:4Oe/raeMC7j0N2ScqlQLaaBCxkxn5mwUZf4sMb8SYjpvogYp6U/NOkiejuI:Oravc0cyK9r5mvf4qJYpx1Okier

Score
10/10
raccoon8f4e4706e9b4e3a904862901d32e2123discoveryspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

8f4e4706e9b4e3a904862901d32e2123

C2

http://78.159.103.196

http://78.159.103.214/
rc4.plain

Targets

    • Target

      launch.exe

    • Size

      6.3MB

    • MD5

      a5efe5d52d9088a7e07770d7c7050a4a

    • SHA1

      7906dfa3eb1ddc0536df7b26f0477c29853fe685

    • SHA256

      81ae7aea498cdd4d50470b3dcd54088d7bce5bf5f6019b08d9d558acd190cb4d

    • SHA512

      9069fdb6ae023af7a7ef30796a0633d9e4d073d959f067b4ad73fb625235a3376c110004a2dbc497e9b20935342b77d118c960cb6f7c00ca2d32d67e47c063b0

    • SSDEEP

      98304:4Oe/raeMC7j0N2ScqlQLaaBCxkxn5mwUZf4sMb8SYjpvogYp6U/NOkiejuI:Oravc0cyK9r5mvf4qJYpx1Okier

    Score
    10/10
    raccoon8f4e4706e9b4e3a904862901d32e2123discoveryspywarestealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks