Overview

overview

10

Static

static

2fc0f46e2c...51.exe

windows7-x64

10

2fc0f46e2c...51.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951

  • Size

    315KB

  • Sample

    221130-az8jdacg75

  • MD5

    44cc89f694f276b2879e84b0e48d6f42

  • SHA1

    1518b4e367f4971c1eb390b439c1ed0f12e03294

  • SHA256

    65c7b8cac9d2a87a4f1d39f5f6e7e754cc103f494c22b7fe8d441cc9409024bf

  • SHA512

    03e0d43c7790f70b10d1419a455f67464a380adf60da2e304a58edeb66b185a1c69e6e5205a38524c7b67fa752f18496baff4b0d04d0b1e6137a3c46a815dd42

  • SSDEEP

    6144:fPZpOOaTvL6p+1+Ud4xajiuzopB9Rdm1pRjWBk0OVpWy8RW:fPnOzTvL6ZW48jiu8pB9RdmpRqBk0Y4W

Score
10/10
raccoon5d704573a0f97fb52a93667085c18b77discoveryspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

5d704573a0f97fb52a93667085c18b77

C2

http://193.106.191.150/

rc4.plain

Targets

    • Target

      2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951

    • Size

      912KB

    • MD5

      b417d6f0345b7af1f5dfe584978d8546

    • SHA1

      00e67099c87df3f1548793400b1193e423b2de18

    • SHA256

      2fc0f46e2ceded0b284d4f41759de65e73532900202260b98769ebfaf3244951

    • SHA512

      5a27af515f5913e59c754f49fffae145a76cf540ec4c2b460f08e8b5cd44a53f672b6fb42c845423d2c9ef03170e233d3c1a8ce9273f2a426375b526cd6f9b0c

    • SSDEEP

      12288:OMBxceTvLcZWyM5h8pB9RdmpdKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKL:OuCeTAAyD9RdN9P9m

    Score
    10/10
    raccoon5d704573a0f97fb52a93667085c18b77discoveryspywarestealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks