Overview

overview

10

Static

static

5ecffed4d2...48.exe

windows7-x64

10

5ecffed4d2...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5ecffed4d2c1e2535b69ea9ed0216606203f712e3e8ef9a3af2ca0b5762ea648

  • Size

    395.1MB

  • Sample

    220907-jtgm5sbdb2

  • MD5

    6e304cd6d12c0d31869ed6e45fff4633

  • SHA1

    a5bb3c851cbf05c88357074ea66e272f839d0537

  • SHA256

    5ecffed4d2c1e2535b69ea9ed0216606203f712e3e8ef9a3af2ca0b5762ea648

  • SHA512

    8ba2a27800e5062ee96d1f3a6f1485584c6762276a2016d7f02c3f33201fd664c77f27d47ec3c8706eed6ba3661116c95aff1213d544f792f83640412b97a1f5

  • SSDEEP

    196608:8YUmSslap7QMHe5HhVrHI/dl/v9TtZJD05y:ldEdCzrHSbv9troy

Score
10/10
raccoon8eb14caca01131f5f4ff62ef8a0fcab4discoveryspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

8eb14caca01131f5f4ff62ef8a0fcab4

C2

http://74.119.192.56/

http://146.19.170.153/
rc4.plain

Targets

    • Target

      5ecffed4d2c1e2535b69ea9ed0216606203f712e3e8ef9a3af2ca0b5762ea648

    • Size

      395.1MB

    • MD5

      6e304cd6d12c0d31869ed6e45fff4633

    • SHA1

      a5bb3c851cbf05c88357074ea66e272f839d0537

    • SHA256

      5ecffed4d2c1e2535b69ea9ed0216606203f712e3e8ef9a3af2ca0b5762ea648

    • SHA512

      8ba2a27800e5062ee96d1f3a6f1485584c6762276a2016d7f02c3f33201fd664c77f27d47ec3c8706eed6ba3661116c95aff1213d544f792f83640412b97a1f5

    • SSDEEP

      196608:8YUmSslap7QMHe5HhVrHI/dl/v9TtZJD05y:ldEdCzrHSbv9troy

    Score
    10/10
    raccoon8eb14caca01131f5f4ff62ef8a0fcab4discoveryspywarestealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks