Overview

overview

10

Static

static

7

df4be4cd13...3c.exe

windows7-x64

7

df4be4cd13...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18b80be4ccf569476db98955ad019621.bin

  • Size

    1010KB

  • Sample

    240708-cnkpaaxflk

  • MD5

    a7b5c1294e904777492939f3bb5cac8d

  • SHA1

    f22df0e388307ddebd32ce846df11c69f549448f

  • SHA256

    a3ade1c4b6644c4870a4d038a51353bfc7bd2f039fe7342d2126c3d9d46cd9e8

  • SHA512

    9fa8b8b9ce6021d8bb3b2fe1cb684bf9985c297ce4d227fc423fb877d5e6270041a3427c24f4675c4adab318221d53e210adda882fa2dbade911817adbb3ca3a

  • SSDEEP

    24576:UlD3eXDsmyMzDYGNQZ2QCcyjLEJ9zYCqBAN2z3bOsVK:UtOThyMz9w6EJiCqBAN2DbO+K

Score
10/10
raccoon1a5d06870a6b84740b2c11dce573e9a0stealerupx

Malware Config

Extracted

Family

raccoon

Botnet

1a5d06870a6b84740b2c11dce573e9a0

C2

http://95.169.205.186:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      df4be4cd1353fcc4da27d21950f9080647884f8985cac8a5c54cc8f5fd2a843c.exe

    • Size

      1.0MB

    • MD5

      18b80be4ccf569476db98955ad019621

    • SHA1

      2c160dc5cd238d9d7f0ca4b4a6419eacb4d6a76b

    • SHA256

      df4be4cd1353fcc4da27d21950f9080647884f8985cac8a5c54cc8f5fd2a843c

    • SHA512

      59565a2a19b8530dd15ac855d361ff7da9e534511787ee296f2e33aad87ebd3141b6e3e0bdd10a34482c0f60bfd644dc5ac11913650998ad6ab84c8f5b2a179f

    • SSDEEP

      24576:ylijFje/d/FERYDhCbMIN5gCwRBXZSFm5qvlxoCCvcAk02D8GHz:hBje/d/FEONirgCmXZ6mQdHCvcLL8Oz

    Score
    10/10
    upxraccoon1a5d06870a6b84740b2c11dce573e9a0stealer

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

      stealerraccoon

    • Raccoon Stealer V2 payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks