General
- Target SecuriteInfo.com.Win32.Evo-gen.22605.exe
- Size 205KB
- Sample220909-jktaksdfhk
- SHA256 8a40814ff8c008d254cceccca174641b028284e498c20bfb5156dfeca935c10d
- MD5 69efb72407a42943162534ec7cd4e7ea
- SHA1 6bf6709866fb42342c2eaac933926ef95f03b7b9
- SHA512 3f52b0541e4f065392bf26f3b326bed76a0d40ae2bcdc13796734620d47b6e36220fd1efeb5ae45a7368eb911de419e3acef357cb396d50563fc2e31be236332
- SSDEEP 3072:MrcR+nIy6BLd3X65AxxinGw2ywsvSUoj+is6pV0EY4WR:jRZLdPkpwgobHY4
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Evo-gen.22605.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.Evo-gen.22605.exe
Resource
win10v2004-20220901-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
raccoon
Botnet
-
567d5bff28c2a18132d2f88511f07435
C2
-
http://116.203.167.5/
-
http://195.201.248.58/
rc4.plain
Targets
-
- Target SecuriteInfo.com.Win32.Evo-gen.22605.exe
- Size 205KB
- SHA256 8a40814ff8c008d254cceccca174641b028284e498c20bfb5156dfeca935c10d
- MD5 69efb72407a42943162534ec7cd4e7ea
- SHA1 6bf6709866fb42342c2eaac933926ef95f03b7b9
- SHA512 3f52b0541e4f065392bf26f3b326bed76a0d40ae2bcdc13796734620d47b6e36220fd1efeb5ae45a7368eb911de419e3acef357cb396d50563fc2e31be236332
- SSDEEP 3072:MrcR+nIy6BLd3X65AxxinGw2ywsvSUoj+is6pV0EY4WR:jRZLdPkpwgobHY4
- MD5 SHA1 SHA512 SSDEEP
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.