Overview

overview

10

Static

static

2fc0f46e2c...51.exe

windows7-x64

10

2fc0f46e2c...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951

  • Size

    315KB

  • Sample

    221130-ax436sfh3y

  • MD5

    dcebfcec7c9d2c11406ebc9300747fb5

  • SHA1

    4ecde50a5f4b250fc47c9da31dcc23b888d92f87

  • SHA256

    84827d010fe9f3eafea526d1ca6c5b45760575ac2dcd87a8ede3fc95421a8761

  • SHA512

    8e7ea8f539819b938b2c615ece459844d0bfec1e315d1f824cacb28d1f5b70e43c7d78ad9e7909c3cdbcb88997ec6dabf2477ac009ad7a5962e21a9fdb9fa7f8

  • SSDEEP

    6144:DPZpOOaTvL6p+1+Ud4xajiuzopB9Rdm1pRjWBk0OVpWy8RS:DPnOzTvL6ZW48jiu8pB9RdmpRqBk0Y4S

Score
10/10
raccoon5d704573a0f97fb52a93667085c18b77discoveryspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

5d704573a0f97fb52a93667085c18b77

C2

http://193.106.191.150/

rc4.plain

Targets

    • Target

      2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951

    • Size

      912KB

    • MD5

      b417d6f0345b7af1f5dfe584978d8546

    • SHA1

      00e67099c87df3f1548793400b1193e423b2de18

    • SHA256

      2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951

    • SHA512

      5a27af515f5913e59c754f49fffae145a76cf540ec4c2b460f08e8b5cd44a53f672b6fb42c845423d2c9ef03170e233d3c1a8ce9273f2a426375b526cd6f9b0c

    • SSDEEP

      12288:OMBxceTvLcZWyM5h8pB9RdmpdKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKL:OuCeTAAyD9RdN9P9m

    Score
    10/10
    raccoon5d704573a0f97fb52a93667085c18b77discoveryspywarestealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks