General

  • Target

    92d20a87ae3af0877463da266823fe48.exe

  • Size

    165KB

  • Sample

    230714-mkc55sdb92

  • MD5

    92d20a87ae3af0877463da266823fe48

  • SHA1

    825872fa988112d8ed8efdf0a8a22d4ad44a5b3d

  • SHA256

    b7682e332b297b35b0d5a9b1961c9aa7a13a7f25af5fa939f795b4286d620925

  • SHA512

    d0c20cbf07d8d3b73cb6e490696fb07471677b23564d68e3019fa360b95d77a25dd579a9b4a61b15997c33f2aaa16460bbd6051d8e00dd632ca112b532fe4394

  • SSDEEP

    3072:O/ELcD48PYETgjpreNbYs4TaB4RZI5w+:iELcDTgtwbPw+

Malware Config

Extracted

Family

raccoon

Botnet

6e489b600db6a7cfd6a1b65b9a5a61eb

C2

http://5.78.111.161:8088/

xor.plain

Targets

    • Target

      92d20a87ae3af0877463da266823fe48.exe

    • Size

      165KB

    • MD5

      92d20a87ae3af0877463da266823fe48

    • SHA1

      825872fa988112d8ed8efdf0a8a22d4ad44a5b3d

    • SHA256

      b7682e332b297b35b0d5a9b1961c9aa7a13a7f25af5fa939f795b4286d620925

    • SHA512

      d0c20cbf07d8d3b73cb6e490696fb07471677b23564d68e3019fa360b95d77a25dd579a9b4a61b15997c33f2aaa16460bbd6051d8e00dd632ca112b532fe4394

    • SSDEEP

      3072:O/ELcD48PYETgjpreNbYs4TaB4RZI5w+:iELcDTgtwbPw+

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer payload

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks