Overview

overview

10

Static

static

9063dd7d69...9c.exe

windows7-x64

10

9063dd7d69...9c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9063dd7d69236cca3007587ccc04334b4289ec456f6983673f3d9f749092a29c

  • Size

    905KB

  • Sample

    221126-tz2wdagf34

  • MD5

    9c5d85678a8ec8b2e2f76181caae00a2

  • SHA1

    856c940b292030783dfbc145f53060940d485384

  • SHA256

    391ac8f4fae35911890a24712283327b26be37c04377adbac4941be6bde7be18

  • SHA512

    48cd3d0b9a6df201e29f7d8b27426e34385ee73d1d98873f00a827412dc3e1b74edc529aaed9e40ede333d84037ee1db020c0d494fd9e39bab7eaf17858185ca

  • SSDEEP

    12288:qnC9Na/vMINcxDBwSXEwsoJKr90uCIUXnOV/vqFalrSZx9exK94p/BwXN4oDrfBu:X/aXM/IDoguOnVE41p/+XN4+pM/Opw

Score
10/10
raccoon5d704573a0f97fb52a93667085c18b77discoveryspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

5d704573a0f97fb52a93667085c18b77

C2

http://193.106.191.150/

rc4.plain

Targets

    • Target

      9063dd7d69236cca3007587ccc04334b4289ec456f6983673f3d9f749092a29c

    • Size

      914KB

    • MD5

      6ef647cfe131f11e48e3acfd2b52595d

    • SHA1

      27a369afc3127e58c968c4ea07a69c3e0053e8db

    • SHA256

      9063dd7d69236cca3007587ccc04334b4289ec456f6983673f3d9f749092a29c

    • SHA512

      ca65119068e2f5a13700971d69cecddf56266dbe4ba0a45654a15a9254909e6997cc8a9b16c51b406dcbd45da22b3798d50550ea89cf741b9f6f2a4c2a316b05

    • SSDEEP

      24576:3QGX47KXoN7mu8x65nf861hFPV+XN4spG/Ojx:HI72oNL8x65nf860c/Oj

    Score
    10/10
    raccoon5d704573a0f97fb52a93667085c18b77discoveryspywarestealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks