General

  • Target

    Setup.exe

  • Size

    726.7MB

  • Sample

    230131-rqxtysae8x

  • MD5

    c5c73e442e6e2581a7b82620ca35000b

  • SHA1

    904f581635c55c5be9735a27b024dac8d1e7dfa4

  • SHA256

    88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64

  • SHA512

    15986b4d3f8f7284861445c2c10c7be97aa849404e941b2600c024a2ddb3ce4e4fddd7e0792b7b2635374d971e09c06c1b594204e7362745e50c4ed185ca7a73

  • SSDEEP

    196608:ex1ywBXWOEW7/IuV7YTIE1eAF+8k0Kq14EgQbtGGI:ex1lVEWrp8T9j88kNq14EndI

Malware Config

Extracted

Family

raccoon

Botnet

4e27b39e9aaa6403f36702b4d66f5024

C2

http://94.142.138.10/

http://94.142.138.9/

rc4.plain

Targets

    • Target

      Setup.exe

    • Size

      726.7MB

    • MD5

      c5c73e442e6e2581a7b82620ca35000b

    • SHA1

      904f581635c55c5be9735a27b024dac8d1e7dfa4

    • SHA256

      88645bc9da6ddd1789ad2af11e91a808a7e5f5b8c858687106766b3f64441d64

    • SHA512

      15986b4d3f8f7284861445c2c10c7be97aa849404e941b2600c024a2ddb3ce4e4fddd7e0792b7b2635374d971e09c06c1b594204e7362745e50c4ed185ca7a73

    • SSDEEP

      196608:ex1ywBXWOEW7/IuV7YTIE1eAF+8k0Kq14EgQbtGGI:ex1lVEWrp8T9j88kNq14EndI

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Tasks