raccoon | 8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3 | Triage

Submit
Reports

Overview

overview

Static

static

6c37651911...18.exe

windows7-x64

6c37651911...18.exe

windows10-2004-x64

Sharing

General

Target

6c3765191111fc238bbfedf10df00d16_JaffaCakes118
Size

2.3MB
Sample

240523-zm5dmaga24
MD5

6c3765191111fc238bbfedf10df00d16
SHA1

343e2816c224b1ad0583c352002c041dc872d329
SHA256

8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3
SHA512

35fcaccbcc69aeb2f2112b5824ae9e5cff8c1853e1bef9c89705b4c1c882b06d809301c2c077d6d4a42c0729945f2aa6c611b5453fa87c6de6ae50936b086bc1
SSDEEP

49152:DaW8D7Dlg7zV2lnQ0V9RG+YckvPcy8vx58hti3NL/hjIBbfyc8v16wEE7lqLK6p:n+lg7zs7V9cLJUy8v38ni3NbhjIBbaNy

Score

10^/10

raccoon evasion stealer themida trojan

Static task

static1

themida raccoon

3 signatures

Behavioral task

behavioral1

Sample

6c3765191111fc238bbfedf10df00d16_JaffaCakes118.exe

Resource

win7-20240221-en

raccoon evasion stealer themida trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

6c3765191111fc238bbfedf10df00d16_JaffaCakes118.exe

Resource

win10v2004-20240508-en

raccoon evasion stealer themida trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  6c3765191111fc238bbfedf10df00d16_JaffaCakes118
- Size
  
  2.3MB
- MD5
  
  6c3765191111fc238bbfedf10df00d16
- SHA1
  
  343e2816c224b1ad0583c352002c041dc872d329
- SHA256
  
  8f226e81f2d25f9f3e2e741a0d3487128144583d79de64d903f1121fde9f42d3
- SHA512
  
  35fcaccbcc69aeb2f2112b5824ae9e5cff8c1853e1bef9c89705b4c1c882b06d809301c2c077d6d4a42c0729945f2aa6c611b5453fa87c6de6ae50936b086bc1
- SSDEEP
  
  49152:DaW8D7Dlg7zV2lnQ0V9RG+YckvPcy8vx58hti3NL/hjIBbfyc8v16wEE7lqLK6p:n+lg7zs7V9cLJUy8v38ni3NbhjIBbaNy
Score

10^/10

raccoon evasion stealer themida trojan
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Raccoon Stealer V1 payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

raccoonevasionstealerthemidatrojan

behavioral2

raccoonevasionstealerthemidatrojan

© 2018-2025

Terms | Privacy