General

  • Target

    4bd8e7c0da18cf09a5ad975bc2a94641e210b164c264425612a02d2d1cadc4b2.exe

  • Size

    2.5MB

  • Sample

    221021-ahdyfacff4

  • MD5

    60ac62fef6a0c0746213164fe9c703e3

  • SHA1

    71607f62db536f672b08020307a63ad1f15082d1

  • SHA256

    4bd8e7c0da18cf09a5ad975bc2a94641e210b164c264425612a02d2d1cadc4b2

  • SHA512

    40456bae758a28efc0b834895d8363ec4608b4e3704ba5fd4335975974089217b90d8a915ef0893f92f6083676e7ee65a060d172f24881983379eba059d889d4

  • SSDEEP

    24576:Vo4W59E2lYKYVwtPb2Moxq2DdxMn4LeKD6ZVYWUGTYH+LEitcl3RuQ55313T:Vo4W59ERA4WUGTYH+wNl39

Malware Config

Extracted

Family

raccoon

Botnet

ce21570f8b07f4e68bfb7f44917635b1

C2

http://77.73.133.7/

rc4.plain

Targets

    • Target

      4bd8e7c0da18cf09a5ad975bc2a94641e210b164c264425612a02d2d1cadc4b2.exe

    • Size

      2.5MB

    • MD5

      60ac62fef6a0c0746213164fe9c703e3

    • SHA1

      71607f62db536f672b08020307a63ad1f15082d1

    • SHA256

      4bd8e7c0da18cf09a5ad975bc2a94641e210b164c264425612a02d2d1cadc4b2

    • SHA512

      40456bae758a28efc0b834895d8363ec4608b4e3704ba5fd4335975974089217b90d8a915ef0893f92f6083676e7ee65a060d172f24881983379eba059d889d4

    • SSDEEP

      24576:Vo4W59E2lYKYVwtPb2Moxq2DdxMn4LeKD6ZVYWUGTYH+LEitcl3RuQ55313T:Vo4W59ERA4WUGTYH+wNl39

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Defense Evasion

Scripting

1
T1064

Tasks