General
-
Target
9bf79c4eea7098f7ccec3230946bf05befd47718194df94d18b99444afbc7075
-
Size
490KB
-
Sample
231210-1jvkpaech2
-
MD5
4aea166ab1af034fe64b95c4d89d062a
-
SHA1
3844aff425a172236e082f9721c55d4a456b1a3b
-
SHA256
9bf79c4eea7098f7ccec3230946bf05befd47718194df94d18b99444afbc7075
-
SHA512
d0bc243ed07edc5cbdd0538b211fa7ec7b3e936c0d6cfa4b6f4433bf13afc2ae56ba48467174cfa686cf9991c18ff19cef85eddda49236403e6fe104c808a29b
-
SSDEEP
6144:Kh4FvAGaZJbvtGEjbOLlc+DWEx3EI/8BjV40KCyqnTpge+T4sP:Kh40ZJbvtGEjbuc+DH3E0RCyaNglT
Static task
static1
Malware Config
Extracted
http://89.23.98.143:30020/receive
Extracted
amadey
http://5.42.66.32
-
strings_key
770b33c35f4c9fa1490bc855b11e57bc
-
url_paths
/g8samsA2/index.php
Extracted
amadey
4.13
http://5.42.66.32
-
install_dir
3df7a97f01
-
install_file
Utsysc.exe
-
strings_key
770b33c35f4c9fa1490bc855b11e57bc
-
url_paths
/g8samsA2/index.php
Extracted
raccoon
bb40861824ba44befee652a03d45206f
http://5.42.64.45:80
-
user_agent
MrBidenNeverKnow
Targets
-
-
Target
9bf79c4eea7098f7ccec3230946bf05befd47718194df94d18b99444afbc7075
-
Size
490KB
-
MD5
4aea166ab1af034fe64b95c4d89d062a
-
SHA1
3844aff425a172236e082f9721c55d4a456b1a3b
-
SHA256
9bf79c4eea7098f7ccec3230946bf05befd47718194df94d18b99444afbc7075
-
SHA512
d0bc243ed07edc5cbdd0538b211fa7ec7b3e936c0d6cfa4b6f4433bf13afc2ae56ba48467174cfa686cf9991c18ff19cef85eddda49236403e6fe104c808a29b
-
SSDEEP
6144:Kh4FvAGaZJbvtGEjbOLlc+DWEx3EI/8BjV40KCyqnTpge+T4sP:Kh40ZJbvtGEjbuc+DH3E0RCyaNglT
-
Raccoon Stealer V2 payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-