General

  • Target

    d1d286e4d020229c0296c49dba5a4c7a4df9b55c62107b6562d41566136096ad

  • Size

    6.9MB

  • Sample

    220924-mexycsbag4

  • MD5

    bfe0d543d420cf99e37637a622c40e3a

  • SHA1

    d2c3200c10f5160e0cbf5596e9e2e06e9be2234e

  • SHA256

    d1d286e4d020229c0296c49dba5a4c7a4df9b55c62107b6562d41566136096ad

  • SHA512

    3cca57962b6c7a9e159516c1b3fde48473f38414f723d2daa3a07fafa9c3b007077423983effa2984c10a0ea9ac0de5b627deef48d3c49e2b37e1a4efe807a94

  • SSDEEP

    98304:DoV1lbPsgZi8knR61cdVMNarKMEFhN01jPatcbI/fVb66QUHtSmqvsZRAjq2Iawy:DYJknDdVy9MGN++/fVu6QUkmwsZKjS

Malware Config

Extracted

Family

raccoon

Botnet

30983d9f29580bfa36d11934e219e205

C2

http://176.124.218.249/

rc4.plain

Targets

    • Target

      d1d286e4d020229c0296c49dba5a4c7a4df9b55c62107b6562d41566136096ad

    • Size

      6.9MB

    • MD5

      bfe0d543d420cf99e37637a622c40e3a

    • SHA1

      d2c3200c10f5160e0cbf5596e9e2e06e9be2234e

    • SHA256

      d1d286e4d020229c0296c49dba5a4c7a4df9b55c62107b6562d41566136096ad

    • SHA512

      3cca57962b6c7a9e159516c1b3fde48473f38414f723d2daa3a07fafa9c3b007077423983effa2984c10a0ea9ac0de5b627deef48d3c49e2b37e1a4efe807a94

    • SSDEEP

      98304:DoV1lbPsgZi8knR61cdVMNarKMEFhN01jPatcbI/fVb66QUHtSmqvsZRAjq2Iawy:DYJknDdVy9MGN++/fVu6QUkmwsZKjS

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks