Overview

overview

10

Static

static

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    119ee01755a7d9ea1e4864fcdcacacd6b71847e61751c25e4abc04be6dd6a704

  • Size

    616KB

  • Sample

    221111-16t8faeh6y

  • MD5

    449486f7ad495390d40866850ef107c0

  • SHA1

    f2ed64627b9de4e2539d967d7df9ab3db3fe6342

  • SHA256

    119ee01755a7d9ea1e4864fcdcacacd6b71847e61751c25e4abc04be6dd6a704

  • SHA512

    f9dcbb27e34c9de91629df7ad5f82dbacea658f8cc7e7d27fa3b36bbd88d559851bf86d364a1d2ebd5e20f382908cd5b7aaa36a7de4da9b7d0fb37395caa4939

  • SSDEEP

    12288:l1fScoCadDc4ptm9xk6AStnkeemEigJkqtKCyQz27QuuEXMjS1PQfLg:l1fSczadDc4pt2lEig6qtKCWs2

Score
10/10
raccoond8f44b07b06da3a90ad87ebc9249718cspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

d8f44b07b06da3a90ad87ebc9249718c

C2

http://79.137.205.87/

rc4.plain

Targets

    • Target

      119ee01755a7d9ea1e4864fcdcacacd6b71847e61751c25e4abc04be6dd6a704

    • Size

      616KB

    • MD5

      449486f7ad495390d40866850ef107c0

    • SHA1

      f2ed64627b9de4e2539d967d7df9ab3db3fe6342

    • SHA256

      119ee01755a7d9ea1e4864fcdcacacd6b71847e61751c25e4abc04be6dd6a704

    • SHA512

      f9dcbb27e34c9de91629df7ad5f82dbacea658f8cc7e7d27fa3b36bbd88d559851bf86d364a1d2ebd5e20f382908cd5b7aaa36a7de4da9b7d0fb37395caa4939

    • SSDEEP

      12288:l1fScoCadDc4ptm9xk6AStnkeemEigJkqtKCyQz27QuuEXMjS1PQfLg:l1fSczadDc4pt2lEig6qtKCWs2

    Score
    10/10
    raccoond8f44b07b06da3a90ad87ebc9249718cstealerspyware

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks