raccoon | d5db5758c1dbfadd019016ea79cbf15edf1e8b9ffb866992b2d3ad6c6bda5189 | Triage

Sharing

General

Target

d5db5758c1dbfadd019016ea79cbf15edf1e8b9ffb866992b2d3ad6c6bda5189
Size

61KB
Sample

220923-1mappahhh5
MD5

9202b048027ba5f33d3bbecfcefed80a
SHA1

5da1261d241004c9498951165dfd0c9578fab00e
SHA256

d5db5758c1dbfadd019016ea79cbf15edf1e8b9ffb866992b2d3ad6c6bda5189
SHA512

fb9a4867014971a7639e21b1e37ae6cc1bd8bad0b5c01e59b5f2e30e5050dd1afd82c3eebca49eedaaa0e88c720343909ca2d27780455607929d7b0a1e611be9
SSDEEP

768:G3hBdh98zo8hUzAMgRt5O9hDtqCD+4yNdQiEw6ZjqZeS6RNUhSC:AdMzAzjavO9uG+NNdQ4MGQR6v

Score

10^/10

raccoon 7394a7fc5da9794209d8b0503ca4abf4 discovery spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

7394a7fc5da9794209d8b0503ca4abf4

C2

http://88.119.171.62

rc4.plain

Targets

- Target
  
  d5db5758c1dbfadd019016ea79cbf15edf1e8b9ffb866992b2d3ad6c6bda5189
- Size
  
  61KB
- MD5
  
  9202b048027ba5f33d3bbecfcefed80a
- SHA1
  
  5da1261d241004c9498951165dfd0c9578fab00e
- SHA256
  
  d5db5758c1dbfadd019016ea79cbf15edf1e8b9ffb866992b2d3ad6c6bda5189
- SHA512
  
  fb9a4867014971a7639e21b1e37ae6cc1bd8bad0b5c01e59b5f2e30e5050dd1afd82c3eebca49eedaaa0e88c720343909ca2d27780455607929d7b0a1e611be9
- SSDEEP
  
  768:G3hBdh98zo8hUzAMgRt5O9hDtqCD+4yNdQiEw6ZjqZeS6RNUhSC:AdMzAzjavO9uG+NNdQ4MGQR6v
Score

8^/10

discovery spyware stealer
- Downloads MZ/PE file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

7394a7fc5da9794209d8b0503ca4abf4raccoon

behavioral1

discoveryspywarestealer