General

  • Target

    390af7d0e1ccb0a68c5213dd0db33231.exe

  • Size

    164KB

  • Sample

    230714-h6mt9acf28

  • MD5

    390af7d0e1ccb0a68c5213dd0db33231

  • SHA1

    b3c0aeea6e661db163427e77f7f0bce76fac0e3e

  • SHA256

    5ea2508d626f1060a23f8bcc6d113f1ea7508de0f8be144b7455eff451397549

  • SHA512

    88d1cc14bcea9422a799ad87a717e7e810fd3015556c0fa2ada6c502a7b8848ef0e28bde2b0668bf38a549abc902a0c9c8623446594714bc685cb315395ad6a3

  • SSDEEP

    3072:ECmGLoEu4RQF7F/2h18WiO68oWeWJXZMUx7Ltbj6Jh5vV+Yl:4GLoj4eF7F/k1piONneWHMUxftb4V+A

Malware Config

Extracted

Family

raccoon

Botnet

6e489b600db6a7cfd6a1b65b9a5a61eb

C2

http://5.78.111.161:8088/

xor.plain

Targets

    • Target

      390af7d0e1ccb0a68c5213dd0db33231.exe

    • Size

      164KB

    • MD5

      390af7d0e1ccb0a68c5213dd0db33231

    • SHA1

      b3c0aeea6e661db163427e77f7f0bce76fac0e3e

    • SHA256

      5ea2508d626f1060a23f8bcc6d113f1ea7508de0f8be144b7455eff451397549

    • SHA512

      88d1cc14bcea9422a799ad87a717e7e810fd3015556c0fa2ada6c502a7b8848ef0e28bde2b0668bf38a549abc902a0c9c8623446594714bc685cb315395ad6a3

    • SSDEEP

      3072:ECmGLoEu4RQF7F/2h18WiO68oWeWJXZMUx7Ltbj6Jh5vV+Yl:4GLoj4eF7F/k1piONneWHMUxftb4V+A

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer payload

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks