Overview

overview

10

Static

static

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a

  • Size

    3.3MB

  • Sample

    220921-16egzshbc3

  • MD5

    4d05c920040c671e49187a179033c50b

  • SHA1

    387a1318539ff16974c21ed6e78fbcbe8e73e3fa

  • SHA256

    24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a

  • SHA512

    f86f5a2e11ceed5a212ae1c61d1c1f31d125ee09cd007610db0db0720fedc08d874807defa029136e6c063ab1e03f47b67298d25a827ebe45ce7f774e5c79849

  • SSDEEP

    49152:Duvjict75qI24MnFmAhxC5fGQRbZtU4axGtOEdzx5onb5EnWcq3jAvKUYgeGc:Duvjict4nFLxafGQNTUNxNMLoVtcWdP

Score
10/10
eternityraccoon30983d9f29580bfa36d11934e219e205persistencestealer

Malware Config

Extracted

Family

eternity

Attributes
  • payload_urls

    http://178.20.44.214/edgedownload.exe

    http://178.20.44.214/a.exe

Extracted

Family

raccoon

Botnet

30983d9f29580bfa36d11934e219e205

C2

http://176.124.218.249/

rc4.plain

Targets

    • Target

      24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a

    • Size

      3.3MB

    • MD5

      4d05c920040c671e49187a179033c50b

    • SHA1

      387a1318539ff16974c21ed6e78fbcbe8e73e3fa

    • SHA256

      24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a

    • SHA512

      f86f5a2e11ceed5a212ae1c61d1c1f31d125ee09cd007610db0db0720fedc08d874807defa029136e6c063ab1e03f47b67298d25a827ebe45ce7f774e5c79849

    • SSDEEP

      49152:Duvjict75qI24MnFmAhxC5fGQRbZtU4axGtOEdzx5onb5EnWcq3jAvKUYgeGc:Duvjict4nFLxafGQNTUNxNMLoVtcWdP

    Score
    10/10
    eternityraccoon30983d9f29580bfa36d11934e219e205persistencestealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks