General

  • Target

    b60a8715b94b4cd82173d56c9cbdc996.exe

  • Size

    239KB

  • Sample

    230711-p872jaab8v

  • MD5

    b60a8715b94b4cd82173d56c9cbdc996

  • SHA1

    18782277fd0abae7a0e8749cc39c4499d907c2c9

  • SHA256

    658bf19572536cbad64c1ac758e4dccd58a0fd88e80c4cefe02e0a3afcf04854

  • SHA512

    d6b2a619cb45273a1c69b9610917b0abe0180822722232930f32c0eaaf294532a683b1c0cb6bd4b345c50c883b7855306cba99d29275ae5366fe5df85da9e915

  • SSDEEP

    3072:hggdLn6OvRCbxp7j5TqTZ7rAhgAWCb9j2ig8A4exW3ZdCV3/HF:egdL6U27jF6ZHAlWe2P8A4ZK3PF

Malware Config

Extracted

Family

raccoon

Botnet

6bb5fbdb7121bc7ea628330bef79c129

C2

http://5.78.78.150:8088/

xor.plain

Targets

    • Target

      b60a8715b94b4cd82173d56c9cbdc996.exe

    • Size

      239KB

    • MD5

      b60a8715b94b4cd82173d56c9cbdc996

    • SHA1

      18782277fd0abae7a0e8749cc39c4499d907c2c9

    • SHA256

      658bf19572536cbad64c1ac758e4dccd58a0fd88e80c4cefe02e0a3afcf04854

    • SHA512

      d6b2a619cb45273a1c69b9610917b0abe0180822722232930f32c0eaaf294532a683b1c0cb6bd4b345c50c883b7855306cba99d29275ae5366fe5df85da9e915

    • SSDEEP

      3072:hggdLn6OvRCbxp7j5TqTZ7rAhgAWCb9j2ig8A4exW3ZdCV3/HF:egdL6U27jF6ZHAlWe2P8A4ZK3PF

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer payload

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks