General
-
Target
09e5c6db3ddafacd61fd8231a55b08ad.bin
-
Size
3.1MB
-
Sample
230328-bgec9agb67
-
MD5
aab820e9687192e1939e738883c5e67e
-
SHA1
ca3e18e43db65e840ccbd495b6b461728dc140b3
-
SHA256
a3cb429152bf36be0db416b6a4271fd47cbe5260d77a927ca70e4bd75e115cfe
-
SHA512
ab12e385b6a12258e86c58a5fd3a4b97eae9a091f0c4565ac48321b1163ae687085542efdaf350b10a5883cb1796e5322904c331a920d5f9535df88c27c5eb7c
-
SSDEEP
49152:TtsUbklKeN9sPUU9btXLAReUdoRBqDsI9ASTYYizsIcwbeaGt/8f67xAY+1NQHfH:jbPeN9stAReUeoD6STAl7aakkf6WfQn/
Behavioral task
behavioral1
Sample
4fd0c9d8fafa4d4f81d0d70ca966e7921c4736c4dfef9051af3fc1ccf20f3966.exe
Resource
win7-20230220-en
Malware Config
Extracted
raccoon
540b1db0b12b23e63e6942952aa03e47
http://45.9.74.36/
http://45.9.74.34/
Targets
-
-
Target
4fd0c9d8fafa4d4f81d0d70ca966e7921c4736c4dfef9051af3fc1ccf20f3966.exe
-
Size
3.8MB
-
MD5
09e5c6db3ddafacd61fd8231a55b08ad
-
SHA1
a4444b5029718fcf540a92a8d7f7cf55dd462198
-
SHA256
4fd0c9d8fafa4d4f81d0d70ca966e7921c4736c4dfef9051af3fc1ccf20f3966
-
SHA512
44e673d66bc55fa547c8f14040299328af698de9782121f64ed86ecd1dc1c8ca85ae911deac60438b73c3d9be568ab7fe6244636d85895fe660e15b66fd0b727
-
SSDEEP
98304:3Vde8FivCeGDRsiSc/XBgZrzyWGgRSL6O2jSk6adBNWuz+VRD0MbQT:HZFwAur6XBazEgRSSjS5aT1z+/D0yQT
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-