General
-
Target
aad928ec7a88f5570de0bfaa270d0548.bin
-
Size
3.2MB
-
Sample
230327-cendtabb66
-
MD5
09a5a11cc2f7333109e95b82b8f1de27
-
SHA1
ee718e367ae7bd45de5f27f650897d300f2cb887
-
SHA256
08fb068aae8bfbf4d88d57207312ef0767464f847c51c3794faa472407da1549
-
SHA512
26b22e93c7f45414ab93935470b277b12df04a71be0e6416c9dbb818f985e4b21bcb41fd28f58a98fa228aa38138f40bb8b51a0ddbcac34acc83f061d8f45823
-
SSDEEP
98304:Y/7yDxGUWdXyRAzbVuyoRZaDdA4kDwVNQIqC9JZ:9DxG0RAVuyhpA4kS669JZ
Behavioral task
behavioral1
Sample
afac9fa41b9b5790863b0674e7315bd82bc890c647ac635c4435c4798e65a3dc.exe
Resource
win7-20230220-en
Malware Config
Extracted
raccoon
540b1db0b12b23e63e6942952aa03e47
http://45.9.74.36/
http://45.9.74.34/
Targets
-
-
Target
afac9fa41b9b5790863b0674e7315bd82bc890c647ac635c4435c4798e65a3dc.exe
-
Size
20.0MB
-
MD5
aad928ec7a88f5570de0bfaa270d0548
-
SHA1
084453356043aac2acf583ee9a543275ecb3654a
-
SHA256
afac9fa41b9b5790863b0674e7315bd82bc890c647ac635c4435c4798e65a3dc
-
SHA512
85ce4046d9ac49b2ce38c035276b3597b157d1e0b59153d65a29c8671a1197ec3f32d13c466c725e1cd97a97a2697ebf8d12663486d87db086363237cbbc6f6a
-
SSDEEP
98304:3Vde8FivCeGDRsiSc/XBgZrzyWGgRSL6O2jSk6adBNWuz+VRD0MbQY:HZFwAur6XBazEgRSSjS5aT1z+/D0yQY
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-