Overview

overview

10

Static

static

filesetup_...pg.exe

windows7-x64

1

filesetup_...pg.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    filesetup_v17.3.4.jpg.exe

  • Size

    253KB

  • Sample

    230127-rs1nmabf48

  • MD5

    f50a1d78d091608f158eaccf0868aec3

  • SHA1

    6c8ace1c29eb95542bc19a2170c979e17cff5fca

  • SHA256

    0ba8881e6cc0bfc2c0669f8d96ee6c43afe7b5921dc93a259b4b27a1cfbec1f3

  • SHA512

    95a313e557a22af4e03eeaf556452ed2e65daa4064183ee5feecb984cf2b5ea2541a54789f5cd63d12aed2d1814512a82e03cdf165b5e2338587302f577432fb

  • SSDEEP

    3072:i14gX/gff43ix4iXQs8/NEK39fhEkC9EgaxOldWrS1/jdqw8PjNxtv9Tl0ZgQW6o:i14gZb7WFYQzvuB5U92/GI0/C6V

Score
10/10
raccoon058b163252af946c77f376d3f457096bstealer

Malware Config

Extracted

Family

raccoon

Botnet

058b163252af946c77f376d3f457096b

C2

http://160.119.253.242

rc4.plain

Targets

    • Target

      filesetup_v17.3.4.jpg.exe

    • Size

      253KB

    • MD5

      f50a1d78d091608f158eaccf0868aec3

    • SHA1

      6c8ace1c29eb95542bc19a2170c979e17cff5fca

    • SHA256

      0ba8881e6cc0bfc2c0669f8d96ee6c43afe7b5921dc93a259b4b27a1cfbec1f3

    • SHA512

      95a313e557a22af4e03eeaf556452ed2e65daa4064183ee5feecb984cf2b5ea2541a54789f5cd63d12aed2d1814512a82e03cdf165b5e2338587302f577432fb

    • SSDEEP

      3072:i14gX/gff43ix4iXQs8/NEK39fhEkC9EgaxOldWrS1/jdqw8PjNxtv9Tl0ZgQW6o:i14gZb7WFYQzvuB5U92/GI0/C6V

    Score
    10/10
    raccoon058b163252af946c77f376d3f457096bstealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Blocklisted process makes network request

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks