General

  • Target

    65ec450878ed2ab96aca4035e.exe

  • Size

    197KB

  • Sample

    230704-p27r7aef5z

  • MD5

    65ec450878ed2ab96aca4035e0ae4d66

  • SHA1

    aff770e559911147a95f99d9e62dc93a9b9187d2

  • SHA256

    38428ed69bfa018b637002f8d4c4680a8c6765cf941449de018971b5bfaeb179

  • SHA512

    0da59b3112a035dd3d03eca074775592ac33d0c8c5b0470dd21b23587e37143fdc1b7b4d9ad8d740ab9e1a8bccde083839ee14d3f8847264eba260453294e6cd

  • SSDEEP

    6144:wthtPLgQ8oeiehLZ3eNr/PKwMdfNUahOC+:QMQ8nJ3e9P49u

Malware Config

Extracted

Family

raccoon

Botnet

385573eb8024f2ce9fbfd9c1ba5d4cd4

C2

http://5.78.65.112:8988/

xor.plain

Targets

    • Target

      65ec450878ed2ab96aca4035e.exe

    • Size

      197KB

    • MD5

      65ec450878ed2ab96aca4035e0ae4d66

    • SHA1

      aff770e559911147a95f99d9e62dc93a9b9187d2

    • SHA256

      38428ed69bfa018b637002f8d4c4680a8c6765cf941449de018971b5bfaeb179

    • SHA512

      0da59b3112a035dd3d03eca074775592ac33d0c8c5b0470dd21b23587e37143fdc1b7b4d9ad8d740ab9e1a8bccde083839ee14d3f8847264eba260453294e6cd

    • SSDEEP

      6144:wthtPLgQ8oeiehLZ3eNr/PKwMdfNUahOC+:QMQ8nJ3e9P49u

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer payload

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks