Overview

overview

10

Static

static

7

setup.exe

windows7-x64

10

setup.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SIackSetupWin.iso

  • Size

    7.3MB

  • Sample

    230630-pmlamscb3s

  • MD5

    05d8e1398832c2dbac7df6f687a0ca2b

  • SHA1

    27ed48967dd5cf89fe5527a677f5763e00a46d85

  • SHA256

    2cb5e093f5a3f66eb869547917b426a614d43fcde752f46de192a8f2f9602671

  • SHA512

    3b4d33e7467961e7c000a7792655ba2a290e7c0e130116609961a2a453483ed6ad1d5dc0082659a35f65d5f2576db408847d6b0b3eb4bc38ce41d72a4d19bab2

  • SSDEEP

    98304:VQG23fmewHtW7ZgPsy8WtNyDqmNiRMkJlSqxegWtIoZv082OQvG5N8pbso2x+x:CaQy86+iRM8EIegG/ZvhWrgj6

Score
10/10
raccoon417f00e313b534b6267434933616178bevasionstealerthemidatrojan

Malware Config

Extracted

Family

raccoon

Botnet

417f00e313b534b6267434933616178b

C2

http://193.149.185.171

http://193.149.180.60

http://193.149.187.34
xor.plain

Targets

    • Target

      setup.exe

    • Size

      6.7MB

    • MD5

      7fdff809af7d3b25c76709165a78a89e

    • SHA1

      6a62910a88111aad6a22924a8e1d1a35626f6bee

    • SHA256

      e1689f695b580c88f6b58274cfed905541749bd86f9f3cd95b70ae22387313ca

    • SHA512

      925fbf207a628989230ccbdb16e41eb8a54c9df801e05f4a3ee71d8f66557e97fdef7453b89f50f73d8ef812edb7ff43178a367a4f1f67b901ef1972cb35f950

    • SSDEEP

      98304:yQG23fmewHtW7ZgPsy8WtNyDqmNiRMkJlSqxegWtIoZv082OQvG5N8pbso2x+x:jaQy86+iRM8EIegG/ZvhWrgj6

    Score
    10/10
    raccoon417f00e313b534b6267434933616178bevasionstealerthemidatrojan

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer payload

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks