General

  • Target
    Softiwe_Download.rar
  • Size 6.2MB
  • Sample221110-w2ly2secfj
  • SHA256 8aa57051e2d9b8d7398e47b5cdabd32df0b28696a32d1d44a8bb6b463b1f3ddb
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • raccoon

Botnet
  • d2f643fdb867ca6beffc12549d6afb13

C2
  • http://167.235.134.14/

rc4.plain

Targets

    • Target
      Softiwe Download/Softiwe Download.exe
    • Size 6.2MB
    • SHA256 8fb50a574fd1aa8828c17c9aee81ba2b08a435290eca3f2830e5a41d65199b52
    • MD5 SHA1 SHA512 SSDEEP
    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Target
      Softiwe Download/kerneld.v64
    • Size 33KB
    • SHA256 27375351b4a723465f937866f0ffc86e8e612b093673ee25ccf0b7ea803f888f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Softiwe Download/storelib.dll
    • Size 159KB
    • SHA256 6b29cad1f6da51f45b7164758a16328eaac9f31021e9172dd3d2f1d0d672da99
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      Softiwe Download/storelibir-2.dll
    • Size 275KB
    • SHA256 833cdbcac5781d350af6939422c770b5194de1bc0cc1bbd38cd929256f440bbf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      Softiwe Download/storelibir.dll
    • Size 259KB
    • SHA256 5f5ebabf5143c8afcbaa4eff5e92af251ae483acd3a9ddddd2f743ba07e54019
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10

MITRE ATT&CK Enterprise v6

Tasks