General

  • Target

    0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe

  • Size

    2.3MB

  • Sample

    240723-r5ea6avhlk

  • MD5

    010d3ed12031239d3f314f66bb28d58d

  • SHA1

    9daa168735a3f72e715f87d952a18f6c8f00238c

  • SHA256

    0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87

  • SHA512

    07234248dcb4d331e15bc102d83442723e5c887ded4cb8b9a66a288ea72560b7b85c169e08d192a035ff757dc8b0efdb555af97e7171bb378d17cd1c35a4e863

  • SSDEEP

    49152:MJ8U/HLU3Yp7dPM8V/HLU3Yp7CgUxK3h7/SEyIas8JWsa6HdLm:MJ8U/HQ3r8V/HQ3BbxKxD9jXsj9Lm

Malware Config

Extracted

Family

raccoon

Botnet

dd188c0be5001b2c8fb76d74174694cd

C2

http://147.45.44.25:80/

http://85.28.47.116:80/

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87.exe

    • Size

      2.3MB

    • MD5

      010d3ed12031239d3f314f66bb28d58d

    • SHA1

      9daa168735a3f72e715f87d952a18f6c8f00238c

    • SHA256

      0e63ba9976f0a65f778b70c452659aff5b2845c212d58b2583a4c90363626b87

    • SHA512

      07234248dcb4d331e15bc102d83442723e5c887ded4cb8b9a66a288ea72560b7b85c169e08d192a035ff757dc8b0efdb555af97e7171bb378d17cd1c35a4e863

    • SSDEEP

      49152:MJ8U/HLU3Yp7dPM8V/HLU3Yp7CgUxK3h7/SEyIas8JWsa6HdLm:MJ8U/HQ3r8V/HQ3BbxKxD9jXsj9Lm

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks