General
- Target 9fae1c2fb440f524912b0a4b6d290b6f.exe
- Size 295KB
- Sample220911-hkshlsbbc8
- SHA256 570c8bfbfe83183e8cf87d989d2a0bee76da03f0db2061578629d3939a4a42f7
- MD5 9fae1c2fb440f524912b0a4b6d290b6f
- SHA1 5302136017c727f55609384260af62a59e9554ab
- SHA512 087ea234731dcb9b422b8003777e77d698df23cba9a9f3f36d98abc225b3cff87029ad43ee27bf7e40576d3e666191d6b3529b68fcf8bca552123370bc2a1e66
- SSDEEP 6144:c2hOl5gX/tpIgrl7fovM/BNUISIncK/t3Amb3TlPGYgkZjdXW:c952/jIgZTyM/BuYcKZAmNRjVW
- MD5 SHA1 SHA512 SSDEEP
Static task
static1
Behavioral task
behavioral1
Sample
9fae1c2fb440f524912b0a4b6d290b6f.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
9fae1c2fb440f524912b0a4b6d290b6f.exe
Resource
win10v2004-20220812-en
7 signatures
150 seconds
Malware Config
Extracted
Family
-
raccoon
Botnet
-
567d5bff28c2a18132d2f88511f07435
C2
-
http://116.203.167.5/
-
http://195.201.248.58/
rc4.plain
Targets
-
- Target 9fae1c2fb440f524912b0a4b6d290b6f.exe
- Size 295KB
- SHA256 570c8bfbfe83183e8cf87d989d2a0bee76da03f0db2061578629d3939a4a42f7
- MD5 9fae1c2fb440f524912b0a4b6d290b6f
- SHA1 5302136017c727f55609384260af62a59e9554ab
- SHA512 087ea234731dcb9b422b8003777e77d698df23cba9a9f3f36d98abc225b3cff87029ad43ee27bf7e40576d3e666191d6b3529b68fcf8bca552123370bc2a1e66
- SSDEEP 6144:c2hOl5gX/tpIgrl7fovM/BNUISIncK/t3Amb3TlPGYgkZjdXW:c952/jIgZTyM/BuYcKZAmNRjVW
- MD5 SHA1 SHA512 SSDEEP
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.