General

  • Target

    3bb302253b249b71b5ddcbb788fe9fdda21be8c7575cc145262e9de161e21baf

  • Size

    3.0MB

  • Sample

    240816-kp8fqszblr

  • MD5

    87a2c8c458d663ea2a1048d14322af1f

  • SHA1

    0d959d98ebc089302e39263ba67e318d5cf30a91

  • SHA256

    3bb302253b249b71b5ddcbb788fe9fdda21be8c7575cc145262e9de161e21baf

  • SHA512

    335acd96043d29fe2a0536c2f10c0804f0752b455326bd9ddfb518a5403c83a2ff38b352c80a1cda052b72b93581d4953f487e54a9470476d6d76f3abfab92eb

  • SSDEEP

    24576:WUz+4cv3r+ys6rm4xEJ2DU4yHcEUVFmCDjanwtTP:W/zv3r+y3EgVyHVCDjOwp

Malware Config

Extracted

Family

raccoon

Botnet

51aff6e9402ba30682487f3dfa017fcf

C2

http://195.20.16.155:80

Attributes
  • user_agent

    MrBidenNeverKnow

xor.plain

Targets

    • Target

      3bb302253b249b71b5ddcbb788fe9fdda21be8c7575cc145262e9de161e21baf

    • Size

      3.0MB

    • MD5

      87a2c8c458d663ea2a1048d14322af1f

    • SHA1

      0d959d98ebc089302e39263ba67e318d5cf30a91

    • SHA256

      3bb302253b249b71b5ddcbb788fe9fdda21be8c7575cc145262e9de161e21baf

    • SHA512

      335acd96043d29fe2a0536c2f10c0804f0752b455326bd9ddfb518a5403c83a2ff38b352c80a1cda052b72b93581d4953f487e54a9470476d6d76f3abfab92eb

    • SSDEEP

      24576:WUz+4cv3r+ys6rm4xEJ2DU4yHcEUVFmCDjanwtTP:W/zv3r+y3EgVyHVCDjOwp

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer V2 payload

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks