Overview

overview

10

Static

static

3

ae0586d416...fe.exe

windows7-x64

10

ae0586d416...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae0586d416a2c1310947a1017c43c0d95b04e80892804b3c61090b2087de0dfe

  • Size

    17.6MB

  • Sample

    231120-lwk5fsfh7t

  • MD5

    1fbf52eb4aa5fb5609bb63535e283835

  • SHA1

    a96aa7fb149885cbdbf1dd3fc529c003c82f6cbb

  • SHA256

    ae0586d416a2c1310947a1017c43c0d95b04e80892804b3c61090b2087de0dfe

  • SHA512

    41e70df4b62465849bd10cd48d8e8966721575e3ede2c7c07b1e511fbd864687e1095a0351f80361cf2f69946b7fcc519e4bddd4e5a24126f05a0d747bbadb56

  • SSDEEP

    393216:bu8SVoCsr12eyexwQ+/bDiZJKIIbsSSUmAWFPx/UQ0:bu8SVoCJeyexwVzcIoVA4Px/T0

Score
10/10
raccoon8c43462d3009db225c4c0889737572cdstealer

Malware Config

Extracted

Family

raccoon

Botnet

8c43462d3009db225c4c0889737572cd

C2

http://94.142.138.49:80/

http://94.142.138.108:80/
Attributes
  • user_agent

    DuckTales

xor.plain

Targets

    • Target

      ae0586d416a2c1310947a1017c43c0d95b04e80892804b3c61090b2087de0dfe

    • Size

      17.6MB

    • MD5

      1fbf52eb4aa5fb5609bb63535e283835

    • SHA1

      a96aa7fb149885cbdbf1dd3fc529c003c82f6cbb

    • SHA256

      ae0586d416a2c1310947a1017c43c0d95b04e80892804b3c61090b2087de0dfe

    • SHA512

      41e70df4b62465849bd10cd48d8e8966721575e3ede2c7c07b1e511fbd864687e1095a0351f80361cf2f69946b7fcc519e4bddd4e5a24126f05a0d747bbadb56

    • SSDEEP

      393216:bu8SVoCsr12eyexwQ+/bDiZJKIIbsSSUmAWFPx/UQ0:bu8SVoCJeyexwVzcIoVA4Px/T0

    Score
    10/10
    raccoon8c43462d3009db225c4c0889737572cdstealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer payload

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks