raccoon | 012f2a099189f63fdcdb669d62c71fe0145703894a74760fc1ab1ee5df9cb15f | Triage

Sharing

General

Target

file
Size

141KB
Sample

221114-yqs94ahf7z
MD5

6483b81d1f900670afa673c7b6051a18
SHA1

7b35404c6155ae98d53af9f4c2b434b7723e8693
SHA256

012f2a099189f63fdcdb669d62c71fe0145703894a74760fc1ab1ee5df9cb15f
SHA512

79dafc3a1e95e28ee8ffd1f54748ce0c1b32efdcde6a61a0743fb200cb58e39ec1a7318f0ce39148b7fe4a5e61e0cde6b6dd42cdc33f9283656bd411e62d499e
SSDEEP

3072:zvursvrUTYpzgoRyAmEl/OTNaG0Vl31iwHHN:zvuYvkYdHpTiwHN

Score

10^/10

raccoon 53508e7dc4e08bd33122d190a04a1200 spyware stealer

Malware Config

Extracted

Family

raccoon

Botnet

53508e7dc4e08bd33122d190a04a1200

C2

http://45.15.156.105/

rc4.plain

Targets

- Target
  
  file
- Size
  
  141KB
- MD5
  
  6483b81d1f900670afa673c7b6051a18
- SHA1
  
  7b35404c6155ae98d53af9f4c2b434b7723e8693
- SHA256
  
  012f2a099189f63fdcdb669d62c71fe0145703894a74760fc1ab1ee5df9cb15f
- SHA512
  
  79dafc3a1e95e28ee8ffd1f54748ce0c1b32efdcde6a61a0743fb200cb58e39ec1a7318f0ce39148b7fe4a5e61e0cde6b6dd42cdc33f9283656bd411e62d499e
- SSDEEP
  
  3072:zvursvrUTYpzgoRyAmEl/OTNaG0Vl31iwHHN:zvuYvkYdHpTiwHN
Score

10^/10

raccoon 53508e7dc4e08bd33122d190a04a1200 stealer spyware
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Downloads MZ/PE file
- Loads dropped DLL
- Uses the VBS compiler for execution
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

raccoon53508e7dc4e08bd33122d190a04a1200stealer

behavioral2

raccoon53508e7dc4e08bd33122d190a04a1200spywarestealer