General

  • Target

    setupsoftapp19.0.exe

  • Size

    846MB

  • Sample

    230130-dh344sga7x

  • MD5

    c924d548d6362d6182a801e5ac9779a2

  • SHA1

    ceef050c6d3476ba14afbcb7f9fae2383409f5b6

  • SHA256

    692665962615caa30b77c4ac254668ed936d4025712d9338f272d6649f700698

  • SHA512

    0c669977725c8808dac6570c7a2dc8071f3cc97679fdbdd348a458f421f400a94c4725306c503277c59d62e3cb0de634d739f13b48467715762e8a284b05af5d

  • SSDEEP

    98304:4bAOzokQ2Kr/ar2QhHe8J7ouoFGxqMI8jZuF++U62mcx/:qc/V8J7ou31I4t+r

Malware Config

Extracted

Family

raccoon

Botnet

3f4a8564e5026a245d6974b020b3f6de

C2

http://45.15.156.225/

rc4.plain

Targets

    • Target

      setupsoftapp19.0.exe

    • Size

      846MB

    • MD5

      c924d548d6362d6182a801e5ac9779a2

    • SHA1

      ceef050c6d3476ba14afbcb7f9fae2383409f5b6

    • SHA256

      692665962615caa30b77c4ac254668ed936d4025712d9338f272d6649f700698

    • SHA512

      0c669977725c8808dac6570c7a2dc8071f3cc97679fdbdd348a458f421f400a94c4725306c503277c59d62e3cb0de634d739f13b48467715762e8a284b05af5d

    • SSDEEP

      98304:4bAOzokQ2Kr/ar2QhHe8J7ouoFGxqMI8jZuF++U62mcx/:qc/V8J7ou31I4t+r

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks