Overview

overview

10

Static

static

10

be63ce4cb1...d9.exe

windows7-x64

10

be63ce4cb1...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be63ce4cb1e1971703a0ca76e22cb7d9.bin

  • Size

    382.7MB

  • Sample

    230324-ckmpgabe98

  • MD5

    be63ce4cb1e1971703a0ca76e22cb7d9

  • SHA1

    a4b171295350288b8a5e24839e935c2ee0e632ed

  • SHA256

    08d07528c86624226a1faf469eb7b933dc008cc0481d58ea54e01701f20ea083

  • SHA512

    0b017c7987334fd6cb8deadf076767194cb59b5e08683420624cff6e8683957d7c31b7de1db3349d3a72bf25f786fa4fe90ff19199d6fc26e2e7da093c95ebb6

  • SSDEEP

    98304:5pZaUiri4dpdDVvCmFjXmFgxIjfOd2QQjawas074kmcXB56rPABPjRW:5ervTVai8TOhQjA4v46rPCRW

Score
10/10
raccoonbeb318f98fe6babad403e7374a09cbb5evasionstealerthemidatrojan

Malware Config

Extracted

Family

raccoon

Botnet

beb318f98fe6babad403e7374a09cbb5

C2

http://185.234.247.68/

http://193.38.54.165/
rc4.plain

Targets

    • Target

      be63ce4cb1e1971703a0ca76e22cb7d9.bin

    • Size

      382.7MB

    • MD5

      be63ce4cb1e1971703a0ca76e22cb7d9

    • SHA1

      a4b171295350288b8a5e24839e935c2ee0e632ed

    • SHA256

      08d07528c86624226a1faf469eb7b933dc008cc0481d58ea54e01701f20ea083

    • SHA512

      0b017c7987334fd6cb8deadf076767194cb59b5e08683420624cff6e8683957d7c31b7de1db3349d3a72bf25f786fa4fe90ff19199d6fc26e2e7da093c95ebb6

    • SSDEEP

      98304:5pZaUiri4dpdDVvCmFjXmFgxIjfOd2QQjawas074kmcXB56rPABPjRW:5ervTVai8TOhQjA4v46rPCRW

    Score
    10/10
    raccoonbeb318f98fe6babad403e7374a09cbb5evasionstealerthemidatrojan

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks