raccoon | hxxp://www[.]google[.]com/ | Triage

Submit
Reports

Overview

overview

Static

static

1

URLScan

urlscan

http://www.google.co...

windows10-2004-x64

Sharing

General

Target

http://www.google.com/
Sample

230421-nzwfpshc2y

Score

10^/10

raccoon redline f26f614d4c0bc2bcd6601785661fb5cf infostealer spyware stealer

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://www.google.com/

Resource

win10v2004-20230220-en

raccoon redline f26f614d4c0bc2bcd6601785661fb5cf infostealer spyware stealer

windows10-2004-x64

16 signatures

1800 seconds

Malware Config

Extracted

Family

redline

C2

45.15.157.131:36457

Attributes

auth_value
f4bbe99787a086a2bbc36d534a2de4f4

Extracted

Family

raccoon

Botnet

f26f614d4c0bc2bcd6601785661fb5cf

C2

http://37.220.87.66/

xor.plain

Targets

- Target
  
  http://www.google.com/
Score

10^/10

raccoon redline f26f614d4c0bc2bcd6601785661fb5cf infostealer spyware stealer
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Executes dropped EXE
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

urlscan1

behavioral1

raccoonredlinef26f614d4c0bc2bcd6601785661fb5cfinfostealerspywarestealer

© 2018-2024

Terms | Privacy