Overview

overview

10

Static

static

9063dd7d69...9c.exe

windows7-x64

10

9063dd7d69...9c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9063dd7d69236cca3007587ccc04334b4289ec456f6983673f3d9f749092a29c

  • Size

    905KB

  • Sample

    221126-ttqadsbc8z

  • MD5

    28863ab78ef47124136f2490b6614bab

  • SHA1

    2fe4b5f88e0680a642135adbc908341965f0f78b

  • SHA256

    99a4b7b89646f36c4575815c3602ceb4247605420d274a7ed866177515ae6fb1

  • SHA512

    5e9170f19eeab314a345359e704a1dba4f999247085f08890580f48a4c8d775e13e896d32a92aff0e9d0d7d9af95659ca8e17aecfd56add6bc603622c2f88316

  • SSDEEP

    12288:BnC9Na/vMINcxDBwSXEwsoJKr90uCIUXnOV/vqFalrSZx9exK94p/BwXN4oDrfBb:A/aXM/IDoguOnVE41p/+XN4+pM/Op5

Score
10/10
raccoon5d704573a0f97fb52a93667085c18b77discoveryspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

5d704573a0f97fb52a93667085c18b77

C2

http://193.106.191.150/

rc4.plain

Targets

    • Target

      9063dd7d69236cca3007587ccc04334b4289ec456f6983673f3d9f749092a29c

    • Size

      914KB

    • MD5

      6ef647cfe131f11e48e3acfd2b52595d

    • SHA1

      27a369afc3127e58c968c4ea07a69c3e0053e8db

    • SHA256

      9063dd7d69236cca3007587ccc04334b4289ec456f6983673f3d9f749092a29c

    • SHA512

      ca65119068e2f5a13700971d69cecddf56266dbe4ba0a45654a15a9254909e6997cc8a9b16c51b406dcbd45da22b3798d50550ea89cf741b9f6f2a4c2a316b05

    • SSDEEP

      24576:3QGX47KXoN7mu8x65nf861hFPV+XN4spG/Ojx:HI72oNL8x65nf860c/Oj

    Score
    10/10
    raccoon5d704573a0f97fb52a93667085c18b77discoveryspywarestealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks