raccoon | e50d7612867722fff23e0bb61ae117b5cfe6fc843e17c8c3a4deb413820170c4 | Triage

Resubmissions

12-11-2022 20:38

221112-zev5zsce6x 10

12-11-2022 20:35

221112-zde3dahd97 1

Sharing

General

Target

Crypted.exe
Size

88KB
Sample

221112-zev5zsce6x
MD5

10520eef62249d90e78bb05ea7c67322
SHA1

18fdfad1afa31ca222451e656cb592df7eaaa60f
SHA256

e50d7612867722fff23e0bb61ae117b5cfe6fc843e17c8c3a4deb413820170c4
SHA512

f5071864b34f92704d2ed5aa80029a5d0a42f7fbc5ee5ae4b61088a18f614339fef952c53ebe7496766c19f8d6302f821e8fca953aa712f138560bde73264c22
SSDEEP

1536:kkwsqJnYltZAV8m01IwWSDNHGV4tTl6Nh+qyFdGA2cTdrOoUBmKNeOe8V/m:kkwsqCltSV8kS5/2h+qUdUckoUBmQpev

Score

10^/10

raccoon dbffbdbc9786a5c270e6dd2d647e18ea discovery spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

dbffbdbc9786a5c270e6dd2d647e18ea

C2

http://79.137.205.87/

rc4.plain

Targets

- Target
  
  Crypted.exe
- Size
  
  88KB
- MD5
  
  10520eef62249d90e78bb05ea7c67322
- SHA1
  
  18fdfad1afa31ca222451e656cb592df7eaaa60f
- SHA256
  
  e50d7612867722fff23e0bb61ae117b5cfe6fc843e17c8c3a4deb413820170c4
- SHA512
  
  f5071864b34f92704d2ed5aa80029a5d0a42f7fbc5ee5ae4b61088a18f614339fef952c53ebe7496766c19f8d6302f821e8fca953aa712f138560bde73264c22
- SSDEEP
  
  1536:kkwsqJnYltZAV8m01IwWSDNHGV4tTl6Nh+qyFdGA2cTdrOoUBmKNeOe8V/m:kkwsqCltSV8kS5/2h+qUdUckoUBmQpev
Score

10^/10

raccoon dbffbdbc9786a5c270e6dd2d647e18ea discovery spyware stealer
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Downloads MZ/PE file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

raccoondbffbdbc9786a5c270e6dd2d647e18eadiscoveryspywarestealer