Overview

overview

10

Static

static

338447d40e...16.exe

windows7-x64

1

338447d40e...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdf89cef00011f087f541cf26851ffcf.bin

  • Size

    6.3MB

  • Sample

    230131-le4v8she81

  • MD5

    bcd93257ef044f4ed3e19626f4aac4ea

  • SHA1

    d55d35344779b932b30f32d3837c4d42566b753b

  • SHA256

    70f0d443138e1ccb141a6bdbf7d6503a0505926bc01cff4fd45c8f9833ba9fd6

  • SHA512

    68511398eb66f2acd20cd4e482cf777fddd5d564c90d4d79b85108e91b9bf2b8842800297ceba9da4d6a568b33fddbdeb673e6fe2bf544b30094ef58db667b66

  • SSDEEP

    196608:Ofhr3a1pZj1QGhZ2d1Pgx83tNDGxopSDsZ:uhr3YpZJZhMzfdNDGuZZ

Score
10/10
raccoon1c145396a071df7e490bd2cf3def4bdfdiscoverypersistencespywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

1c145396a071df7e490bd2cf3def4bdf

C2

http://45.15.156.215/

rc4.plain

Targets

    • Target

      338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516.exe

    • Size

      7.0MB

    • MD5

      fdf89cef00011f087f541cf26851ffcf

    • SHA1

      415c63fd0a62519ccdd761142baf052db0c9b148

    • SHA256

      338447d40e099471b745ab89c003011a8e3443fd687845a199b76ed67f462516

    • SHA512

      e01dd6913410bc78c234a9ff4a6c26d443335fdc0d8d12a528b8cb86559a2117d162f470181b63b20f857635aab4dd2538515dd3ba35172685c647aa1996f18a

    • SSDEEP

      196608:vWoKh6/86G8izj595XAp9irEsXUX+EKAq:sQwN2LiHX2+EK

    Score
    10/10
    raccoon1c145396a071df7e490bd2cf3def4bdfdiscoverypersistencespywarestealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks