Overview

overview

10

Static

static

1

Satup.exe

windows7-x64

10

Satup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Satup.zip

  • Size

    14.3MB

  • Sample

    230412-p9yjgsdh4y

  • MD5

    e1e1a86b4cb9e56b09ea928647e2b71d

  • SHA1

    286763cb76a23d2d5607ed9df33cd718737663f7

  • SHA256

    f0bc3c483baf7538afcddf023231888e9a338111160df42e3d684286a1d75712

  • SHA512

    fcb6f6197eadf7fe4992e23ab97bad3e5c2b63f9ce62bee6410e84f423a7731803de4936de9fb17661193c1b8babd25940c12bdb0170013b87b91aeae32dbc39

  • SSDEEP

    393216:2cieedOPJRq12mb9qII+f94wx+IWFqxvgC6BeV4k:2wedOPhmb0II+ftCFqdgC6U4k

Score
10/10
raccoon13718a923845c0cdab8ce45c585b8d63discoveryspywarestealer

Malware Config

Extracted

Family

raccoon

Botnet

13718a923845c0cdab8ce45c585b8d63

C2

http://45.15.156.198/

xor.plain

Targets

    • Target

      Satup.ex_

    • Size

      1024.0MB

    • MD5

      47f8832cbd46f8177f199861c65725b8

    • SHA1

      c3fe7f280a978e3bc3c137c96d878a310e362aed

    • SHA256

      9f9059c67c5bb5158ee0eeb6470cd9c25e861f8f58a3f3b339237e1d7c6f67e0

    • SHA512

      48194e0383c260e5a2cd4a6b57cfc2862086bd33f1633de9c0f1571ef4c50a247b7fb1190a783be11d3f6135148bd62331eaa5b7ae1e41b653e99a1283b208eb

    • SSDEEP

      196608:3EEGSLeQvIcM0fqPJI+a8sET0wyxrWRx14AeHDJlTjpWNGQbMaKGMGDrIcMZZp:3ySOcM0fqPJilEwfxKoAqlPuGF8M2CZp

    Score
    10/10
    raccoon13718a923845c0cdab8ce45c585b8d63stealerdiscoveryspyware

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks