Overview

overview

10

Static

static

7

SuT-u.exe

windows7-x64

10

SuT-u.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SеT-uр.zip

  • Size

    2.7MB

  • Sample

    230331-kza8zsae71

  • MD5

    df79847f2499a41f23c5bb130475eba4

  • SHA1

    1a1dfcf2c39dd5014984420d5bb98d7ae6a987a5

  • SHA256

    28e64121b13efe27774b4734ec061af6ef7df96e9882b5f84470ed0de078ba36

  • SHA512

    bd8c34a941e233433b337a813de1c2382b95d16fdf7ef5eba82fece993f722726ca7a3b635680842fd801c5675a06fad19819e35ea55db56d75ded3512ce7438

  • SSDEEP

    49152:mRwHgGYbkEXCrQwPT6qPVLqR3oScZEz7nZCDqG:uwAVHykQmRYSoM7nZC7

Score
10/10
raccoonf26f614d4c0bc2bcd6601785661fb5cf�q�m������e�discoveryspywarestealerupx

Malware Config

Extracted

Family

raccoon

Botnet

f26f614d4c0bc2bcd6601785661fb5cf

C2

http://37.220.87.66/

rc4.plain

Extracted

Family

raccoon

Botnet

�Q�M������e�

rc4.plain

Targets

    • Target

      SuT-u.ex_

    • Size

      1024.0MB

    • MD5

      bbe934b27150221d00e6df6ad67f5b87

    • SHA1

      e6dc3d410c8b86e9e4bddc2daf3fc35a26889247

    • SHA256

      62b16f591fd7cea398eef2123eca605545ae60401d2e5bdaf897d00da4e7f638

    • SHA512

      6a9d814b9369f95745906c131e1db72f09c8cced20349b9c9b48ccfe84090cc766191e7d98be9805c5e1c3a0cd988f7b6b831c1dae0965ad7682a1afd94c60ad

    • SSDEEP

      24576:ewNuU9GH8Hrgi5sWmhA8IP3b4q7W5BfwPxod0KImzcF/WkvMr73L4dbu4t1TcVfp:79GH+g8sWmhIPJ60i0Kp/rodl/TcVfp

    Score
    10/10
    raccoonf26f614d4c0bc2bcd6601785661fb5cf�q�m������e�spywarestealerupxdiscovery

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

File Permissions Modification

1
T1222

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks