Overview

overview

10

Static

static

3

7538ac9e7b...32.exe

windows7-x64

10

7538ac9e7b...32.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7538ac9e7b96e8d73364bf0b6b9b6c32

  • Size

    19.1MB

  • Sample

    240125-w9ff8sdgdl

  • MD5

    7538ac9e7b96e8d73364bf0b6b9b6c32

  • SHA1

    e55e30ad935594489424839e6025064bd8c13717

  • SHA256

    bddd91f972e2fa78e6811aaf3629201dbec33f9b3f284d1d333b6e426539095d

  • SHA512

    cd161929ed0d99037f9f7a1f75596e01c2b6bdfc72887aaf6ee09fa40b1819f5c69527a63730a3ef90eee3cd8462738164ffa2537d9042499433ece7a8a6ec22

  • SSDEEP

    393216:q+fzawW8ZprOBi/o3CfKFcR0vPhfzQJKBQl5Pdw9XgG+GHcC:nzBWErxo3CfKF3hfzuKBQP4wGHcC

Score
10/10
raccoon0343d4da493d263f78921a8724ca6adf05347cfeaspackv2evasionstealertrojan

Malware Config

Extracted

Family

raccoon

Version

1.7.3

Botnet

0343d4da493d263f78921a8724ca6adf05347cfe

Attributes
  • url4cnc

    https://telete.in/jbitchsucks

rc4.plain
rc4.plain

Targets

    • Target

      7538ac9e7b96e8d73364bf0b6b9b6c32

    • Size

      19.1MB

    • MD5

      7538ac9e7b96e8d73364bf0b6b9b6c32

    • SHA1

      e55e30ad935594489424839e6025064bd8c13717

    • SHA256

      bddd91f972e2fa78e6811aaf3629201dbec33f9b3f284d1d333b6e426539095d

    • SHA512

      cd161929ed0d99037f9f7a1f75596e01c2b6bdfc72887aaf6ee09fa40b1819f5c69527a63730a3ef90eee3cd8462738164ffa2537d9042499433ece7a8a6ec22

    • SSDEEP

      393216:q+fzawW8ZprOBi/o3CfKFcR0vPhfzQJKBQl5Pdw9XgG+GHcC:nzBWErxo3CfKF3hfzuKBQP4wGHcC

    Score
    10/10
    raccoon0343d4da493d263f78921a8724ca6adf05347cfeevasionstealertrojanaspackv2

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V1 payload

    • UAC bypass

      evasiontrojan

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

BITS Jobs

1
T1197

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

BITS Jobs

1
T1197

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks