Overview

overview

10

Static

static

whatthefuck.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    whatthefuck.exe

  • Size

    866KB

  • Sample

    220919-gd43dsefhl

  • MD5

    d91b46f4a9cd6fc1a4ac0a82925be6b4

  • SHA1

    51d77db712b467a61ea06c539657815a13363de8

  • SHA256

    0f0120403bdce99af323f1df869e5259fd9de6f78961d5918843b9025572c4d3

  • SHA512

    5963915a7d98513c43b42c06de0a4bad65f040ca8a8f0ce178a5f7e70c790f548707102c09678ac52a67f22539c96b124c03c2e89c1552f3ef632b4359fb0304

  • SSDEEP

    6144:iiUbiUaLZT7ssl5wetP8pa7PffwAGsj8b0T0IgCbHacNxtBhnCyev0XLsEjCoYyG:zUOnZTxm9CHfGAlT07CbHbRh/M07sq+

Score
10/10
raccoon7be6431f3fa3eaa6e36b23bbc5559b9adiscoveryspywarestealerupx

Malware Config

Extracted

Family

raccoon

Botnet

7be6431f3fa3eaa6e36b23bbc5559b9a

C2

http://77.73.133.69/

rc4.plain

Targets

    • Target

      whatthefuck.exe

    • Size

      866KB

    • MD5

      d91b46f4a9cd6fc1a4ac0a82925be6b4

    • SHA1

      51d77db712b467a61ea06c539657815a13363de8

    • SHA256

      0f0120403bdce99af323f1df869e5259fd9de6f78961d5918843b9025572c4d3

    • SHA512

      5963915a7d98513c43b42c06de0a4bad65f040ca8a8f0ce178a5f7e70c790f548707102c09678ac52a67f22539c96b124c03c2e89c1552f3ef632b4359fb0304

    • SSDEEP

      6144:iiUbiUaLZT7ssl5wetP8pa7PffwAGsj8b0T0IgCbHacNxtBhnCyev0XLsEjCoYyG:zUOnZTxm9CHfGAlT07CbHbRh/M07sq+

    Score
    10/10
    raccoon7be6431f3fa3eaa6e36b23bbc5559b9adiscoveryspywarestealerupx

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks