Overview

overview

10

Static

static

3

fe3c627fa5...88.exe

windows7-x64

10

fe3c627fa5...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88

  • Size

    89KB

  • Sample

    240417-hftvwahg2s

  • MD5

    4689fa4b5da75c275204c36d0ef1bd0c

  • SHA1

    f54b9bf584231c7d4ec8254b544de147c8c57870

  • SHA256

    fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88

  • SHA512

    2f8844561392415d811822dcca715ff8d0527a429a218625c98dc475e082a6bb283afa08a604dd610428e35fb9c65d1eb87d32865bfa4832c15ae9e866c9eee1

  • SSDEEP

    1536:WuwkW4cEmvSGLRTifUEj6PqmdZbJcfl2yRKwI8Ejhr7bqTZCEcblP8FQb:Wq8zETm/sNG88hr7bqTcE4GQb

Score
10/10
raccoon8401e21bbb0060afb24ce21fda90f5cbstealer

Malware Config

Extracted

Family

raccoon

Botnet

8401e21bbb0060afb24ce21fda90f5cb

C2

http://195.20.16.155:80

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88

    • Size

      89KB

    • MD5

      4689fa4b5da75c275204c36d0ef1bd0c

    • SHA1

      f54b9bf584231c7d4ec8254b544de147c8c57870

    • SHA256

      fe3c627fa533eb4924e1915f2e2c8a5d07e20f8081de424d805fc850f03dba88

    • SHA512

      2f8844561392415d811822dcca715ff8d0527a429a218625c98dc475e082a6bb283afa08a604dd610428e35fb9c65d1eb87d32865bfa4832c15ae9e866c9eee1

    • SSDEEP

      1536:WuwkW4cEmvSGLRTifUEj6PqmdZbJcfl2yRKwI8Ejhr7bqTZCEcblP8FQb:Wq8zETm/sNG88hr7bqTcE4GQb

    Score
    10/10
    raccoon8401e21bbb0060afb24ce21fda90f5cbstealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V2 payload

    • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks