General

  • Target

    anytoiso_setup.exe

  • Size

    13.4MB

  • Sample

    231011-2ydq6aad6y

  • MD5

    490128ad8c2fe36a4b3430860e61fe30

  • SHA1

    14bd1aa15559ac295d37ba47aa4d612e256fe85b

  • SHA256

    10c72764f6d4d5b571a45cf42034cbb6eaf7c2921bec1f8b52c3540d596c3987

  • SHA512

    730dd70af95f731ed6772eeaeadc3d36a9374ea637d9c40029ceefecd0d1ef72aba61a300e025bb01129e98b3cbf9678f35285b90926ad8a9bbdf468f74994ed

  • SSDEEP

    393216:Bveof0+px5NtgmmehrhTDbTBUJEGkbMAZ7K47:B3pxOmme//y+bhp7

Malware Config

Extracted

Family

raccoon

Botnet

fa72f4c1fbe65cee8651140fd47267ba

C2

http://193.142.147.59:80

Attributes
  • user_agent

    Xmlst

xor.plain

Targets

    • Target

      anytoiso_setup.exe

    • Size

      13.4MB

    • MD5

      490128ad8c2fe36a4b3430860e61fe30

    • SHA1

      14bd1aa15559ac295d37ba47aa4d612e256fe85b

    • SHA256

      10c72764f6d4d5b571a45cf42034cbb6eaf7c2921bec1f8b52c3540d596c3987

    • SHA512

      730dd70af95f731ed6772eeaeadc3d36a9374ea637d9c40029ceefecd0d1ef72aba61a300e025bb01129e98b3cbf9678f35285b90926ad8a9bbdf468f74994ed

    • SSDEEP

      393216:Bveof0+px5NtgmmehrhTDbTBUJEGkbMAZ7K47:B3pxOmme//y+bhp7

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks