Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    564d0b949d2ef24647553ae0246cfa720b2eb52f9e4e1db6e9c14797be8cdd29

  • Size

    624KB

  • Sample

    221105-fsmwzsfhem

  • MD5

    b0a7ecc63bb7077caac69f13f8229ee1

  • SHA1

    4a2f7c91bf707d5c75facfa2e190a0ea78f80a6d

  • SHA256

    564d0b949d2ef24647553ae0246cfa720b2eb52f9e4e1db6e9c14797be8cdd29

  • SHA512

    2f6af0a375c3ae87bbce5b52aa4ec4aac2738ce864388301696afb1479110d577cba478bf0b10c07b89657161044eb9bc86f0a0c1d99ec1e0745ac7305d5df89

  • SSDEEP

    12288:hq6jQkjRQZJpLIPWAWYXls8UNcbZlSH54puhii+wjN+iUvmuOwKWzrEyMYg:hq6jQ0RQZJJIH3bZY5bhii+wCnzrEVd

Malware Config

Extracted

Family

raccoon

Botnet

4cef2ce4f1a8bc40a1ff7364d440a62a

C2

http://79.137.197.212/

rc4.plain

Targets

    • Target

      564d0b949d2ef24647553ae0246cfa720b2eb52f9e4e1db6e9c14797be8cdd29

    • Size

      624KB

    • MD5

      b0a7ecc63bb7077caac69f13f8229ee1

    • SHA1

      4a2f7c91bf707d5c75facfa2e190a0ea78f80a6d

    • SHA256

      564d0b949d2ef24647553ae0246cfa720b2eb52f9e4e1db6e9c14797be8cdd29

    • SHA512

      2f6af0a375c3ae87bbce5b52aa4ec4aac2738ce864388301696afb1479110d577cba478bf0b10c07b89657161044eb9bc86f0a0c1d99ec1e0745ac7305d5df89

    • SSDEEP

      12288:hq6jQkjRQZJpLIPWAWYXls8UNcbZlSH54puhii+wjN+iUvmuOwKWzrEyMYg:hq6jQ0RQZJJIH3bZY5bhii+wCnzrEVd

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks