General

  • Target

    868d0edb3bbabbd7bf56bfcb098ed0f4.exe

  • Size

    184KB

  • Sample

    230714-f4t5facc54

  • MD5

    868d0edb3bbabbd7bf56bfcb098ed0f4

  • SHA1

    34758390eeda581f0828119f5606c97e0aa1e432

  • SHA256

    8f28fbb66f0fcebfed8266bb6c45da8f2da63c2395c77329ee374e4a2c8a3a25

  • SHA512

    850d86e83ae9ada8ce0fcee7fdfebba103489a2de7ea8d8d8b8ed388191061755c3bfb0527284495ffc197ff67c95ad6369b0a1bba3651ba2db4ae42ba42200f

  • SSDEEP

    3072:YgYqLjwYgI8PCBWUi0OxcNAeeu+1ac+oCZMcqpvCZNIMI5XtWU:tBLe8I8OxVlBwc+oCcvCZ2MytW

Malware Config

Extracted

Family

raccoon

Botnet

6e489b600db6a7cfd6a1b65b9a5a61eb

C2

http://5.78.111.161:8088/

xor.plain

Targets

    • Target

      868d0edb3bbabbd7bf56bfcb098ed0f4.exe

    • Size

      184KB

    • MD5

      868d0edb3bbabbd7bf56bfcb098ed0f4

    • SHA1

      34758390eeda581f0828119f5606c97e0aa1e432

    • SHA256

      8f28fbb66f0fcebfed8266bb6c45da8f2da63c2395c77329ee374e4a2c8a3a25

    • SHA512

      850d86e83ae9ada8ce0fcee7fdfebba103489a2de7ea8d8d8b8ed388191061755c3bfb0527284495ffc197ff67c95ad6369b0a1bba3651ba2db4ae42ba42200f

    • SSDEEP

      3072:YgYqLjwYgI8PCBWUi0OxcNAeeu+1ac+oCZMcqpvCZNIMI5XtWU:tBLe8I8OxVlBwc+oCcvCZ2MytW

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer payload

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks