Overview

overview

10

Static

static

3

a680ae77d7...18.exe

windows7-x64

10

a680ae77d7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118

  • Size

    775KB

  • Sample

    240403-zr8lvacf8v

  • MD5

    a680ae77d7dcbc614386f1b4ae2d6574

  • SHA1

    a263a39a2b7fd3c5fb0bb75caa789f2055f3462b

  • SHA256

    e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742

  • SHA512

    21327f7749f36cfa82d13479568ef92dd7737b7fd03fcef0ff55cf0db7511c8306178c597b0dc84383ce5d476cc02ae1e22c032c257a0032cd51fbaba9ff4f16

  • SSDEEP

    12288:WxmGsdY0LoOaHwKeoE4LdPc/u+mVC2Blvt8Y8fAnnac6bVIhh+y:WxEpL6TFFifAnnObmh+

Score
10/10
raccoon4b9b8980a10a7e59f200af975a29a100ba819fe0stealer

Malware Config

Extracted

Family

raccoon

Botnet

4b9b8980a10a7e59f200af975a29a100ba819fe0

Attributes
  • url4cnc

    http://telemirror.top/ararius809b

    http://tgmirror.top/ararius809b

    http://telegatt.top/ararius809b

    http://telegka.top/ararius809b

    http://telegin.top/ararius809b

    https://t.me/ararius809b

rc4.plain
rc4.plain

Targets

    • Target

      a680ae77d7dcbc614386f1b4ae2d6574_JaffaCakes118

    • Size

      775KB

    • MD5

      a680ae77d7dcbc614386f1b4ae2d6574

    • SHA1

      a263a39a2b7fd3c5fb0bb75caa789f2055f3462b

    • SHA256

      e53adf92075e500d8e39bdc48c4e32c6d805062e7f27ac5882fb7681e467c742

    • SHA512

      21327f7749f36cfa82d13479568ef92dd7737b7fd03fcef0ff55cf0db7511c8306178c597b0dc84383ce5d476cc02ae1e22c032c257a0032cd51fbaba9ff4f16

    • SSDEEP

      12288:WxmGsdY0LoOaHwKeoE4LdPc/u+mVC2Blvt8Y8fAnnac6bVIhh+y:WxEpL6TFFifAnnObmh+

    Score
    10/10
    raccoon4b9b8980a10a7e59f200af975a29a100ba819fe0stealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V1 payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks