Overview

overview

10

Static

static

1

b8406c0265...4b.exe

windows7-x64

10

b8406c0265...4b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8406c0265685a3472517f1b8b5d514b.exe

  • Size

    2.1MB

  • Sample

    230405-16r33sbh5z

  • MD5

    b8406c0265685a3472517f1b8b5d514b

  • SHA1

    1c94df97a4580e48860b5d8b543f3ef5b6f5c0d7

  • SHA256

    b242612fab32f3a2bc44033c804e586a12fd450795ba68510a32c67059b6d7b1

  • SHA512

    ebb457e8e4cafa9e0197e235f029b3a67ba1136e93440d638f26251a2a71b120be788579468f56ab271222b42006ddb54979aaa8cd99a652ba84bee7bf382586

  • SSDEEP

    49152:NJ4HLiAIg8bZGZLggVaa6acVbId2cD/ki+aHT+:NJ4HWBXALg+56pkd2+/kl4T+

Score
10/10
gcleanerraccoon81620d6b0f6e4fbb3048818577e1f9beloaderspywarestealerupx

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Extracted

Family

raccoon

Botnet

81620d6b0f6e4fbb3048818577e1f9be

C2

http://91.201.115.148

rc4.plain

Targets

    • Target

      b8406c0265685a3472517f1b8b5d514b.exe

    • Size

      2.1MB

    • MD5

      b8406c0265685a3472517f1b8b5d514b

    • SHA1

      1c94df97a4580e48860b5d8b543f3ef5b6f5c0d7

    • SHA256

      b242612fab32f3a2bc44033c804e586a12fd450795ba68510a32c67059b6d7b1

    • SHA512

      ebb457e8e4cafa9e0197e235f029b3a67ba1136e93440d638f26251a2a71b120be788579468f56ab271222b42006ddb54979aaa8cd99a652ba84bee7bf382586

    • SSDEEP

      49152:NJ4HLiAIg8bZGZLggVaa6acVbId2cD/ki+aHT+:NJ4HWBXALg+56pkd2+/kl4T+

    Score
    10/10
    gcleanerloaderspywarestealerupxraccoon81620d6b0f6e4fbb3048818577e1f9be

    • GCleaner

      GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

      loadergcleaner

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks