raccoon | c73eef378eb054a400fb8163dd3141feaffea91eeb6a1363a41e7e7a88222f53

General

Target
5cef736542d8707af28a2927bb0a09c2.exe
Size 57KB
Sample221111-h1j66sabe3
SHA256 c73eef378eb054a400fb8163dd3141feaffea91eeb6a1363a41e7e7a88222f53
MD5 5cef736542d8707af28a2927bb0a09c2
SHA1 415816c04d498480ef350db4d77651dc17791897
SHA512 9cc502bbe2ffaadc7de2f2ac6aaaadbd1911de0ab6c02420c029041001aa3e649592b0b61e825eb9033147bb47424374181a341586b96128aa1307214a6a3f38
SSDEEP 1536:IVp01Eca2z/LvhbUDZUN1T04K3rJJOFOE:j1EcfBUDZi03K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

raccoon

Botnet

d8f44b07b06da3a90ad87ebc9249718c

C2

http://79.137.205.87/

rc4.plain

Targets

- Target
  5cef736542d8707af28a2927bb0a09c2.exe
- Size 57KB
- SHA256 c73eef378eb054a400fb8163dd3141feaffea91eeb6a1363a41e7e7a88222f53
- MD5 5cef736542d8707af28a2927bb0a09c2
- SHA1 415816c04d498480ef350db4d77651dc17791897
- SHA512 9cc502bbe2ffaadc7de2f2ac6aaaadbd1911de0ab6c02420c029041001aa3e649592b0b61e825eb9033147bb47424374181a341586b96128aa1307214a6a3f38
- SSDEEP 1536:IVp01Eca2z/LvhbUDZUN1T04K3rJJOFOE:j1EcfBUDZi03K
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery spyware stealer
- Downloads MZ/PE file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Downloads MZ/PE file

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2