Overview

overview

10

Static

static

3

1dc9190028...e9.exe

windows7-x64

10

1dc9190028...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b1d7c8e59a48d655b56afd93586d2edc37dcd165bd909a77e100886716495db5

  • Size

    85KB

  • Sample

    240419-vw5njaae25

  • MD5

    ca059697146da235db811963ec714337

  • SHA1

    e037c202534cc0bc0c264ea4f32ba94588587afd

  • SHA256

    b1d7c8e59a48d655b56afd93586d2edc37dcd165bd909a77e100886716495db5

  • SHA512

    13601a204f7dc9297faa4ea0bba1e491896e55226ef86c3fd03bce79c6f35d788fc7de79fbb5cbcda0b096c603906baec7c15e1c3221c95418cf419f4c910a7b

  • SSDEEP

    1536:2BKR5GotCiVO1/ra1QFcbnrOLm3Uo7kaIo42lZsf5ns/wI2sH05exA+LfQs/X:1Goo1/m1Qubrxz5ZO5s/NPL7/X

Score
10/10
raccoon8401e21bbb0060afb24ce21fda90f5cbstealer

Malware Config

Extracted

Family

raccoon

Botnet

8401e21bbb0060afb24ce21fda90f5cb

C2

http://195.20.16.155:80

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9.exe

    • Size

      89KB

    • MD5

      d0fa79fc637c5916da8d7c2f07948933

    • SHA1

      d4fb639fe811739c4adf2e62b5df1f8c9ab35c75

    • SHA256

      1dc9190028637257765735e9e8956d0a2ef2710055fdfc873240c7f09098b7e9

    • SHA512

      68bca697a0cb607b6d813ddd4656afaa617384dbbafecda6b4f03685da8fba8603d761e0cb56841a778e59908064ff93261e80bc2f19f6898240d0b2dd65dd4c

    • SSDEEP

      1536:2PX4YBLPitzZgglqlwEmnFN+br133phXZ4gDjyAKrsTBLviJYPx5OSbDU9oBdh02:ZzZggAlwEAAbryXsTBTiJYPx5OSbEoBN

    Score
    10/10
    raccoon8401e21bbb0060afb24ce21fda90f5cbstealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V2 payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks