General

  • Target

    SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe

  • Size

    5.1MB

  • Sample

    240329-qmskdsab54

  • MD5

    20540ccd8f4132e0fff9daec9f143997

  • SHA1

    0fb2c50a19db4b8f2c6998e85b437780765fd61c

  • SHA256

    25f7e04b4c4fe0f1dc604270cbe8a53433580f9c5372f56abac420de4ced4322

  • SHA512

    4f299318f6e74e7e64e61d9e364327043289607f063c2972a3849c807de74ed30926ad1d19fd6906d57d4a04eb7df1ff635ec0ee9c2cb618820c3efc82ae0043

  • SSDEEP

    98304:Op01tlZUA6nDvod3HAslfqK1k20OWyCwSvNUddSLE9xmc+XXj0Mey6G8Qs:OpilgDvoBhFkvOWASirSLE9x+TZey6GQ

Malware Config

Extracted

Family

raccoon

Botnet

d1fc95c6179be4b0b4f93eff6ab3f08f

C2

http://89.238.170.230:80

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe

    • Size

      5.1MB

    • MD5

      20540ccd8f4132e0fff9daec9f143997

    • SHA1

      0fb2c50a19db4b8f2c6998e85b437780765fd61c

    • SHA256

      25f7e04b4c4fe0f1dc604270cbe8a53433580f9c5372f56abac420de4ced4322

    • SHA512

      4f299318f6e74e7e64e61d9e364327043289607f063c2972a3849c807de74ed30926ad1d19fd6906d57d4a04eb7df1ff635ec0ee9c2cb618820c3efc82ae0043

    • SSDEEP

      98304:Op01tlZUA6nDvod3HAslfqK1k20OWyCwSvNUddSLE9xmc+XXj0Mey6G8Qs:OpilgDvoBhFkvOWASirSLE9x+TZey6GQ

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks